Self-Hosted Weekly: Week 44, 2026. Brotli Hits KEV, HACS Absorbed, Forgejo Patches

A compression library you have never configured, patched in private eight months ago, is now on CISA's actively-exploited list and sitting inside half your stack. Elsewhere, the tools that move your code had a rough week, and Home Assistant is about to absorb the add-on store most of its users depend on.

Let's get into it.

1. Brotli Lands on CISA's Exploited List

The headline is not that Brotli has an out-of-bounds write in its decoder. It is the timeline.

The fix was committed to google/brotli on 27 February 2026 with no release and no advisory. Node.js disclosed it publicly on 21 October as CVE-2026-111497. It is now in CISA's Known Exploited Vulnerabilities catalogue, with the CISA alert dated 27 October, and ELLIO reports exploit traffic from an operator it assesses as running mass exploitation. Imperva demonstrated remote code execution against the official Node.js 24.22.0 Linux arm64 image.

Anything that decompresses attacker-supplied data with a vulnerable decoder is in scope. Tenable's list includes ClickHouse, FFmpeg, Envoy, Istio, Apache Arrow, .NET, Bun and Python HTTP clients.

Hot take: The eight-month silent window is the part worth being angry about. A quiet commit is not a disclosure, and every downstream project that vendors Brotli spent those months shipping a known-vulnerable decoder without being told. If you run ClickHouse or anything that ingests compressed payloads, go and check what it links against rather than assuming your package manager has caught up.

2. Home Assistant Is Absorbing HACS

The 2026.11 beta landed on 28 October, and the headline is structural: HACS becomes the built-in Marketplace, and HACS itself cannot be installed on 2026.11 or newer.

Hot take: Folding the de facto add-on store into core is the right call for a project that depends on it this heavily, and it is still a breaking change for anyone with a HACS-managed integration. If you run Home Assistant and have not read the migration notes, do that before the stable release lands in November rather than after.

3. git-annex Fixes a Cross-Repository Exfiltration

git-annex 10.20261026 closes CVE-2026-112818, found by Joey Hess. A cloned repository could autoenable a special remote pointing at the victim's own private storage, quietly pulling content across a boundary that was never meant to be crossed.

The fix makes enableremote require verified configuration, and content is refused to unverified autoenabled remotes.

Hot take: This is the most interesting bug of the week because it needs no memory corruption and no exploit chain. It is a trust assumption in a config file. Clone a repository, and it tells your tooling where to find storage. That pattern exists in more tools than git-annex.

4. Forgejo Ships Three Security Releases

Forgejo 17.0.1, 16.0.7 and 15.0.11 went out on 26 October. The main fix stops a pull_request_review event from running an Actions workflow as trusted, from an arbitrary commit.

Worth noting separately: 17.0.1 also fixes bugs in 17.0.0 that the project had told users to hold off on.

Hot take: "Runs as trusted from an arbitrary commit" is the CI failure mode that matters, because it converts a review action into code execution with your secrets. If you self-host Forgejo, this is the one to apply today.

5. OVHcloud's CLI Shipped Backdoored Releases

An attacker took over a maintainer's GitHub account and replaced releases 0.11.0 through 0.15.0 of the OVHcloud CLI with backdoored builds that read secrets from disk.

The mechanism is the lesson: release immutability was switched off, so existing releases could simply be overwritten in place. Nobody had to be tricked into installing a new version.

Hot take: Version pinning protects you from a bad new release. It does nothing when the artifact behind a version you already trust is swapped underneath you. Turn on release immutability, and verify checksums you recorded yourself rather than ones fetched at install time.

6. Gheist: Secrets Exfiltrated in Base32 to Dodge Masking

Wiz documented a campaign using stolen GitHub tokens to push a workflow into every repository the token could reach. It encodes secrets in base32 so GitHub's log masking does not recognise them, then deletes the workflow run.

GitHub's hold on suspicious public-repository workflows, in place since 28 July, blocked it there. Private repositories and GitHub Enterprise Server were outside that hold, and Wiz observed successful runs.

Hot take: Secret masking is a readability feature, not a security control. It matches strings. Encode the string and it stops matching. Anyone running GitHub Enterprise Server should read this one properly, because the mitigation that saved public repos did not apply.

7. Catch-Up: Git LFS and Gitea

Two from the days just before this window that deserve a second pass.

Git LFS 3.8.1 (22 October) fixes four CVEs: unquoted arguments in SSH remote commands, cookie headers forwarded to another host after a redirect, arbitrary execution via a line feed in a submodule URL, and arbitrary execution via a custom transfer adapter in .lfsconfig.

Gitea 28.2.0 (18 October) discloses 13 CVEs. One fix limits which stored public keys an SSH certificate principal is matched against, preventing a certificate from authenticating as a different user.

Hot take: Three of the four Git LFS issues trigger on cloning a hostile repository. If your CI clones anything you do not control, that is your threat model, not a theoretical one.

8. GitLab 19.5 Ships Secrets Manager on OpenBao

Something that is not a CVE. GitLab 19.5 makes the GitLab MCP server and the GitLab Secrets Manager, built on OpenBao, generally available.

Hot take: The OpenBao choice is the interesting part. OpenBao is the genuinely open-source Vault fork, and seeing it picked as the foundation for a shipping product in a major forge is a better signal for that project than any amount of foundation press. The MCP server going GA is the more quietly significant half for anyone pointing agents at their own repositories.

What We're Watching Next Week

Home Assistant 2026.11 stable, due in November, and how messy the HACS migration actually is in practice. Also whether the Brotli patches propagate: the library is vendored in enough projects that the long tail will take weeks, and KEV listing means someone is already looking.

The Bottom Line

Brotli and the OVHcloud CLI are the same story told twice. In both cases the dangerous code arrived through something nobody was watching: a vendored dependency in one, an overwritten release artifact in the other. Neither shows up when you check your own version numbers.

Patch Brotli-dependent software and Forgejo today. Read the git-annex advisory even if you do not run it, because the trust assumption it describes is not unique to that tool.

If keeping track of which of your services just shipped a security release is the part you would rather not do by hand, that is what Elestio's managed deployments handle: automated updates, backups and monitoring on infrastructure you still own.

Thanks for reading ❤️ See you next week 👋