PeerTube vulnerability notes

Published on 2026-05-23 13:41

First of all, if you are maintaining a PeerTube instance, please, upgrade it to the latest version. For detailed information why look at Solomon Tech Blog.

Nothing gets me out of my bed on Saturday faster than security issue with my servers. And finding out that my server was affected is even worse.

Fortunately in my case the attacker was not able to install anything as my PeerTube instance was stuck at version 7.3.0 and as Solomon Tech writes, that installation attack started happening after the upgrade to version 8.1.6.

What has happened on Sarah's instance

The attacker was able to create a session under a root user of the instance. According to the logs, there were four contacts from 20.240.202.159. Three were probing, if the server returns a desired response.

20.240.202.159 - - [22/May/2026:14:46:18 +0000] "GET /api/v1/users/me HTTP/2.0" 200 2011 "-" "curl/8.5.0"
20.240.202.159 - - [22/May/2026:15:22:36 +0000] "GET /api/v1/users/me HTTP/2.0" 401 157 "-" "curl/8.5.0"
20.240.202.159 - - [22/May/2026:20:49:17 +0000] "GET /api/v1/users/me HTTP/2.0" 200 2011 "-" "curl/8.5.0"

I'm guessing the first one was a fluke or attacker was getting a lower level access. Because when I try to curl my server on that endpoint, without any token I get:

{"type":"https://docs.joinpeertube.org/api-rest-reference.html#section/Errors/unauthorized_request","detail":"Token is invalid","status":401,"code":"unauthorized_request"}

After the attacker gained access, they tried to install a plugin. Fortunately they've got back HTTP code 400, Bad request. This according to MDN means "server would not process the request due to something the server considered to be a client error."

20.240.202.159 - - [22/May/2026:20:49:18 +0000] "POST /api/v1/plugins/install HTTP/2.0" 400 209 "-" "curl/8.5.0"

What Sarah did to remediate

First was removing the existing session of the attacker. This was followed by several upgrades. As the previous running version of PeerTube was 7.3.0, it was necessary to do this manually as there are two server migrations that needed to be run, one for 8.0.0 and the other for 8.1.0.

In the past I've tried to do the automatic upgrades over several versions and got burned by them.

In the middle of writing this post, version 8.1.8 was released which addresses this attack and even let's administrators to disable the root account completely. I've also checked this things pointed out in the release notes, customisations and plugins. Both looked clean. And on the config level root user was disabled.

Conclusion

If you are running a PeerTube instance, upgrade it to the latest. In case you can't, there's steps what to do in version 8.1.8 release notes.