Self-Hosted Weekly: Week 42, 2026. GitLab CVSS 10, Drupal RCE, Mattermost 12

This was a patch-first week. GitLab fixed a CVSS 10 flaw that let unauthenticated users run code on the server, Drupal shipped a critical remote code execution fix, and Keycloak closed 18 CVEs in one release. Mattermost 12 landed with removals that can stop a server from starting, and PostgreSQL 19 pushed its release date back a month. Here's what mattered.

1. GitLab patches a CVSS 10 RCE, then ships its MCP server

On October 12, GitLab released 19.4.2, 19.3.5 and 19.2.8 with 24 security fixes: one critical, five high, 14 medium and four low. The critical one, CVE-2026-97229 (CVSS 10.0), is an integer overflow in the CI/CD regular expression compiler that "could have allowed an unauthenticated user to execute arbitrary code on the GitLab server." GitLab lists no workaround. Three days later, GitLab 19.5 made its MCP server and the OpenBao-based Secrets Manager generally available.

Our take: Unauthenticated, no user interaction, full code execution: this is the one to drop everything for. The patch includes database migrations, so single-node instances will have downtime. Schedule it today rather than next sprint. If you run GitLab yourself, the jump to 19.5 can wait; the patch can't.

2. Drupal fixes a critical RCE in Field UI

Drupal pre-announced it, and it delivered on October 14: SA-CORE-2026-014, remote code execution in the Field UI module, rated Critical (19/25). Core alone doesn't expose it, but contributed modules do, and the advisory states that "at least one known exploit path does not require authentication." Two moderately critical XSS fixes (Link and Navigation) shipped alongside. Fixed releases are 11.4.10, 11.3.19 and 10.6.19.

Our take: "Not exploitable with core alone" isn't comfort when almost every real Drupal site runs contributed modules. Update now. If you can't, the advisory's suggested stopgap is uninstalling field_ui until you do. It's the admin tool for editing content types and fields, so check that nobody needs it during that window.

3. Keycloak 26.8.1 fixes 18 CVEs

Keycloak 26.8.1 (October 13) is a security release with 18 CVEs. The worrying ones are privilege escalation: a delegated admin with only manage-users can become realm-admin by joining a group that maps an admin role, a 2FA setup enforcement bypass via the login-actions restart endpoint, cross-realm read and write through a session-level cache, and token exchange that skips required mTLS binding. There's also a path traversal through X.509 CRL distribution points and an SMTP STARTTLS downgrade.

Our take: If you use fine-grained admin permissions, which is exactly where several of these bugs live, upgrade Keycloak this week and review who holds manage-users. Two entries are flagged as incomplete fixes of earlier issues, so don't assume last month's patch covered you.

4. Mattermost 12 can refuse to start on old configs

Mattermost v12.0.0 was tagged on October 14. The announced removals are now real: RHEL 7 and 8 are gone (the new build needs glibc 2.36), OpenSearch 1.x is no longer supported, and if ImageProxyType is still set to atmos/camo, the server logs a configuration error and won't start. The web and desktop apps also moved to React 19, which breaks webapp plugins that rely on propTypes, defaultProps on function components, legacy context or string refs.

Our take: The camo setting is the trap, because it fails at startup, not with a warning. Check it, your OpenSearch version and your custom plugins in staging before upgrading Mattermost. Server-only plugins aren't affected by the React change.

5. Vault 2.2 closes policy bypasses and changes container behavior

Vault 2.2.0 (October 15) fixes a privilege escalation where a denied_parameters rule on policies could be bypassed with a mixed-case policy name ("Super-Admin" instead of "super-admin"), a LIST ACL bypass via a trailing slash, and an AWS auth bypass caused by incorrect client caching. ACME now rejects CSRs carrying URI, email or Other SANs. On the Enterprise side, the AI agent registry is generally available.

Our take: Two things for self-hosters. The ACL fixes alone justify upgrading Vault. And read the container notes carefully: the changelog contains two contradictory entries about the IPC_LOCK capability, one saying it was removed (set disable_mlock = true) and one saying it's set at build time (add IPC_LOCK to your runtime). Test the image in staging and check that Vault starts the way your config expects before rolling it out.

6. PostgreSQL 19 RC1 is out, GA slips to November 19

PostgreSQL 19 RC1 shipped on October 15 as planned, but the release date moved. "The planned date for the general availability of PostgreSQL 19 is November 19, 2026," a month after the original target. An RC2 is coming on November 12, alongside the regular update release. Since beta 4, the changes are all fixes: REPACK (CONCURRENTLY), the planner's new NULL-based optimizations, parallel autovacuum and automatic logical replication.

Our take: A slower release with an extra RC is good news. Use the next five weeks to run your test suite and your extensions against RC1. Production PostgreSQL upgrades still go through pg_upgrade or dump and restore, so plan the window now.

7. InfluxDB 3.12 is a one-way upgrade

InfluxDB 3.12.0 (October 15) speeds up bulk import and brings distributed compaction (beta) and per-database schema enforcement. The warning at the top of the release notes matters more: 3.12 writes a catalog record that 3.11 can't read. Once a node starts on 3.12, "you can't roll back to v3.11.x unless you have a catalog backup," whether or not you use the new features.

Our take: Back up the catalog before upgrading. That's the whole take. It applies to Core and Enterprise, and in a cluster the switch happens once every node runs 3.12. If you run InfluxDB behind Grafana dashboards, test one node first.

8. JupyterHub 6.1 and 5.5.3 fix six advisories

JupyterHub 6.1.0 (October 14) fixes six moderate vulnerabilities, all requiring authentication, with backports to 5.5.3. Only one affects most deployments: a denial of service via invalid spawner options. The others hit narrower setups, such as SharedPasswordAuthenticator with admin users, or token_expires_in_max_seconds not being enforced when set.

Our take: Low drama, easy win. Upgrade JupyterHub to 6.1.0, or 5.5.3 if you haven't moved to 6 yet. If you set a maximum token lifetime, the upgrade is what actually enforces it.

What we're watching next week

Ubuntu's kernel fix, week three. Ubuntu's tracker still shows CVE-2026-80521 as "Vulnerable, work in progress" on 24.04 LTS and 26.04 LTS. Keep hosts running untrusted containers isolated.

Kubernetes 1.34 reaches end of life on October 27. Per the Kubernetes release page, 1.34 gets no patches after that date. Clusters still on it should be planning the jump now.

Grafana's four CVEs. Grafana 13.2.4, 13.1.8, 13.0.11 and 12.4.13 (October 13) each fix four CVEs that weren't publicly detailed when we went to press. Upgrade anyway, and we'll report the details once they're published.

The bottom line

Three of this week's fixes can hand an attacker your server: GitLab's without even a login, Drupal's through common contributed modules, and Keycloak's by quietly promoting the wrong admin. Mattermost 12 can refuse to start on an old config, and InfluxDB 3.12 can't be rolled back without a catalog backup. Back up first, test in staging, and get GitLab and Drupal done before the weekend.

Thanks for reading ❤️ See you next Friday 👋