External risk intelligence

PeerTube SQL Injection Vulnerability Allows Database Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73211

PeerTube is a federated video streaming platform designed to be publicly accessible and interact with other servers via ActivityPub. Because it functions as a public-facing web service and relies on accepting external network requests from the internet to operate, the vulnerable endpoint is inherently exposed by design in normal deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the PeerTube video streaming platform that could allow an unauthenticated remote attacker to access and modify database information, potentially leading to unauthorized administrator account takeovers. This issue stems from the improper handling of external data within an SQL query, impacting the platform's ability to maintain data integrity and security.

Unauthenticated remote attackers can steal data or control accounts.
It impacts a federated video streaming platform.
Confirm relevance and exposure of this platform.

Attack Path

How an attacker could exploit the issue

An attacker can target a PeerTube instance by sending a specially crafted ActivityPub message. This message can exploit a vulnerability in how the platform processes follower data, allowing the attacker to inject malicious SQL code. If successful, this allows the attacker to read and write to the PeerTube database, potentially leading to the theft of access tokens and unauthorized control of administrator accounts.

No authentication required to access.
Interpolating inboxUrl into SQL query.
Database compromise and account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to access and modify the PeerTube database. This could include sensitive information like OAuth tokens, and potentially lead to the takeover of administrator accounts.

Database tables and OAuth tokens at risk.
Via interpolated user-controlled inbox URL.
Administrator account takeover possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this critical SQL injection vulnerability in PeerTube typically falls to the platform or application team responsible for its operation and maintenance. The initial action should be to locate all deployed instances of PeerTube, assess their external reachability and business criticality, identify the accountable owner for each instance, and then prioritize remediation efforts based on risk.

Platform/App owners to address.
Verify external reachability and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is PeerTube and how does it function?

PeerTube is a decentralized, open-source video streaming platform. Unlike traditional video sites, it uses the ActivityPub protocol to federate with other servers, allowing different instances to share content and communicate. This architecture relies on receiving and processing data from external servers across the internet to maintain its distributed social network features.

What does CVE-2026-73211 mean for database security?

This vulnerability is classified as an SQL Injection (CWE-89). It occurs when the application incorrectly merges external data—specifically an ActivityPub actor's inbox URL—directly into a database command. Because the system fails to sanitize this input, an attacker can manipulate the query to read from or write to the database, effectively bypassing standard access controls to modify internal tables.

How does an attacker trigger this PeerTube vulnerability?

An attacker initiates this by sending a specially crafted ActivityPub message to a target instance. The bug is triggered when the software processes this message to update follower information. It is important to note that internal administrative actions or standard user interactions with the site interface do not cause this flaw; it specifically requires the processing of malicious, externally provided network data.

Is my PeerTube instance at risk?

According to Halo Surface Signal, instances are highly likely to be exposed because PeerTube is designed to be a public-facing service that must accept external network requests to function. Since the vulnerable component handles federated traffic, any PeerTube instance that is reachable from the internet is inherently accessible to the network-based triggers used to exploit this weakness.

How do I secure my environment against this vulnerability?

The primary response is to update your PeerTube installation to version 8.1.6 or later, as this release includes the necessary patches to safely handle input. Before applying the update, identify all active instances within your network, verify their current version, and prioritize them for maintenance based on their role and connectivity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.