CVE-2026-73211: PeerTube SQL Injection Vulnerability

CVE-2026-73211 Overview

CVE-2026-73211 is a SQL injection vulnerability in PeerTube, an ActivityPub-federated video streaming platform. The flaw resides in the ActorFollowModel.updateScore() method, which interpolates an attacker-controlled ActivityPub actor inboxUrl directly into an SQL query. An unauthenticated remote server that federates with a target PeerTube instance can read and write arbitrary database tables. Exploitation allows extraction of oAuthToken.accessToken values, enabling takeover of administrator accounts. The vulnerability affects all PeerTube versions prior to 8.1.6 and maps to CWE-89.

Critical Impact
Unauthenticated remote SQL injection leading to database read/write and administrator account takeover through federated ActivityPub actors.

Affected Products

PeerTube versions prior to 8.1.6
PeerTube instances federating with untrusted ActivityPub servers
Self-hosted PeerTube deployments exposed to public federation

Discovery Timeline

2026-08-11 - CVE-2026-73211 published to NVD
2026-08-11 - Last updated in NVD database
PeerTube v8.1.6 - Fixed release published on GitHub

Technical Details for CVE-2026-73211

Vulnerability Analysis

The vulnerability is a classic SQL injection in the updateScore() static method of ActorFollowModel, defined in server/core/models/actor/actor-follow.ts. PeerTube tracks the health of federated followers by adjusting a numeric score value on the actorFollow table. When a remote server delivers ActivityPub activities, PeerTube looks up the corresponding row using the actor's inboxUrl and sharedInboxUrl. The inboxUrl value is supplied by the remote server during federation and is not sanitized before being interpolated into the raw SQL string. An attacker who controls a federated ActivityPub server can register an actor whose inboxUrl contains SQL payloads, breaking out of the string literal and appending arbitrary statements.

Root Cause

The root cause is direct string interpolation of untrusted input into a raw SQL statement, bypassing Sequelize's parameter binding. The ${inboxUrl} and ${value} template placeholders were concatenated directly into the query text rather than passed via the bind option. A secondary occurrence in server/core/models/user/user-notification.ts interpolated options.forUserId and options.id similarly.

Attack Vector

An unauthenticated attacker operates a rogue ActivityPub server and initiates federation with the victim PeerTube instance. During the follow or activity exchange, the attacker sets the actor's inboxUrl to a malicious value that closes the SQL string and appends a subquery or UPDATE statement. When PeerTube processes an inbound activity and calls updateScore(), PostgreSQL executes the injected SQL under the PeerTube database role. Attackers can exfiltrate oAuthToken.accessToken tokens and impersonate administrators via the PeerTube REST API.

typescript

// Patch: server/core/models/actor/actor-follow.ts
static updateScore (inboxUrl: string, value: number, t?: Transaction) {
-    const query = `UPDATE "actorFollow" SET "score" = LEAST("score" + ${value}, ${ACTOR_FOLLOW_SCORE.MAX}) ` +
+    const query = 'UPDATE "actorFollow" SET "score" = LEAST("score" + $value, $maxScore) ' +
      'WHERE id IN (' +
      'SELECT "actorFollow"."id" FROM "actorFollow" ' +
      'INNER JOIN "actor" ON "actor"."id" = "actorFollow"."actorId" ' +
-      `WHERE "actor"."inboxUrl" = '${inboxUrl}' OR "actor"."sharedInboxUrl" = '${inboxUrl}'` +
+      'WHERE "actor"."inboxUrl" = $inboxUrl OR "actor"."sharedInboxUrl" = $inboxUrl' +
      ')'

    const options = {
+      bind: {
+        inboxUrl,
+        maxScore: ACTOR_FOLLOW_SCORE.MAX,
+        value
+      },
      type: QueryTypes.BULKUPDATE,
      transaction: t
    }
}
// Source: https://github.com/Chocobozzz/PeerTube/commit/cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4

The patch converts all interpolated values to Sequelize bind parameters, which are sent to PostgreSQL as prepared statement arguments and are never parsed as SQL.

Detection Methods for CVE-2026-73211

Indicators of Compromise

Unexpected UPDATE, SELECT, or INSERT statements in PostgreSQL logs referencing the actorFollow or oAuthToken tables from federation code paths.
Inbound ActivityPub payloads where the actor inboxUrl field contains single quotes, semicolons, comment sequences (--, /*), or PostgreSQL keywords such as UNION, pg_sleep, or COPY.
New or modified administrator sessions correlated in time with federation events from unfamiliar remote instances.
OAuth access tokens issued or reused from IP addresses inconsistent with the legitimate administrator's history.

Detection Strategies

Enable PostgreSQL log_statement = 'all' or pg_stat_statements and alert on queries against oAuthToken originating from the PeerTube application role outside of authentication flows.
Inspect PeerTube application logs for federation errors, malformed actor URLs, or Sequelize query errors referencing syntax issues.
Deploy a web application firewall (WAF) rule in front of the /inbox, /accounts/*/inbox, and /videos/*/inbox endpoints to flag ActivityPub JSON containing suspicious inboxUrl values.

Monitoring Recommendations

Alert on any query pattern touching oAuthToken.accessToken that is not part of the standard OAuth login and refresh flows.
Monitor the actor table for rows with inboxUrl values containing quotes, whitespace anomalies, or non-URL characters.
Track newly federated remote servers and correlate their first activity with subsequent privileged actions on the local instance.

How to Mitigate CVE-2026-73211

Immediate Actions Required

Upgrade PeerTube to version 8.1.6 or later immediately; 8.1.8 is also available and contains the fix.
Rotate all OAuth client secrets and invalidate existing oAuthToken.accessToken values by clearing the oAuthToken table or issuing a forced logout.
Reset administrator and moderator account passwords and audit recent administrative actions for signs of takeover.
Review the actor table for entries whose inboxUrl or sharedInboxUrl contains SQL metacharacters and remove suspicious federated actors.

Patch Information

The fix is available in PeerTube v8.1.6 and later, including v8.1.8. The upstream commit cc07364a5d635b6e43a92fc5e2e2e3eeacf4e8f4 replaces string interpolation with Sequelize bind parameters in actor-follow.ts and user-notification.ts. Full details are documented in GitHub Security Advisory GHSA-pqr4-34h8-g39x.

Workarounds

Temporarily disable ActivityPub federation by restricting inbound /inbox endpoints at the reverse proxy until the patch is applied.
Operate PeerTube in allowlist-only federation mode, accepting activities exclusively from vetted remote instances.
Enforce least-privilege on the PostgreSQL role used by PeerTube so that the application cannot execute unexpected data definition statements.

bash

# Upgrade PeerTube to the patched release
cd /var/www/peertube
sudo -u peertube git fetch origin
sudo -u peertube git checkout v8.1.8
sudo -u peertube yarn install --production --pure-lockfile
sudo systemctl restart peertube

# Invalidate existing OAuth tokens after upgrade
sudo -u postgres psql peertube_prod -c 'TRUNCATE TABLE "oAuthToken";'