Self-Hosted Weekly: Week 46, 2026. SSHole, PostgreSQL's 52 CVEs, wfx-loot

An SSH bug that turns a locked account into an open one, a PostgreSQL release with 52 CVEs, and a campaign that stole CI secrets from more than 1,800 repositories and then deleted its own logs. It was not a quiet week for anyone running their own servers.

Let's get into it.

1. SSHole: When a Locked Account Isn't Locked

CVE-2026-123158, nicknamed SSHole, hits OpenSSH on musl-based Linux systems such as Alpine. BleepingComputer explains the mechanism: an oversized password makes musl's password-hashing function return * on error, and OpenSSH then treats that as a match for accounts whose stored hash is *. Accounts with real password hashes aren't affected.

OpenSSH fixed it in 10.6p2 on November 5. GreyNoise recorded the first successful exploitation about 40 hours later, and CISA added it to its exploited list on November 9 with a deadline of November 12.

Hot take: On Alpine, * is how you mark an account as having no usable password, which is exactly the account you'd assume was safe. If any Alpine container or VM of yours runs sshd, update and restart it today. And ask why it's running sshd at all.

2. PostgreSQL Fixes 52 CVEs, and 14 Is Done

The November 12 releases (18.7, 17.12, 16.16, 15.20 and 14.25) close 52 vulnerabilities. Help Net Security counts 32 of them at CVSS 8.8, most of them memory or type-confusion bugs that can execute code. Client tools are affected too: pg_dump, reindexdb and tar-format restores.

There's work after the upgrade. Reindex suspect GIN indexes, pg_trgm GiST indexes and B-tree indexes on bpchar columns without a length. If you use incremental backups, take a fresh full backup, since several of the fixed bugs could produce corrupt ones. And 14.25 is the last PostgreSQL 14 release ever.

Hot take: "Update the server" isn't enough this time. Update the client binaries you run pg_dump from, do the reindexing, and reset your backup chain. Still on 14? Our upgrade guide went out on Sunday for exactly this week.

3. wfx-loot Steals CI Secrets, Then Deletes the Evidence

Aikido found a campaign it calls wfx-loot, reported by Help Net Security. Since November 10, an attacker using stolen GitHub credentials has opened probe pull requests in 61,764 repositories. In more than 1,800, a roughly 1,500-line script ran and sent off Actions secrets, cloud credentials and AI tool tokens. The attacker then reverted the change and deleted the workflow run and its logs within about a minute.

It also creates long-lived AWS keys, rewrites AWS role trust policies to accept any account, and adds federated credentials to Azure apps. Those survive secret rotation.

Hot take: Look for a wfx-docs branch, a pull request titled "docs: dependency audit notes", or commits like "ci: refresh build cache". If the payload ran, rotating secrets isn't enough: go and check your cloud IAM for the backdoors it leaves behind. This is also a strong argument for short-lived CI credentials over stored ones.

4. Git 2.56.1 Fixes Six Bugs, One on Recursive Clone

Git 2.56.1, with backports down to 2.50.2, fixes six vulnerabilities. The nastiest, CVE-2026-111760, lets a malicious repository swap a submodule's .git file for a symlink during a recursive clone, so attacker-supplied hooks or config run.

Hot take: Self-hosted forges and CI runners clone strangers' repositories all day, so update Git there first, not only on laptops. GitHub Enterprise Server already shipped fixed versions.

5. GPUStack Trusted "Localhost" Behind a Proxy

CISA listed GPUStack's CVE-2026-102895 as exploited on November 9. GPUStack, a self-hosted manager for GPU clusters running AI models, treated requests from loopback as admin without authentication. Behind a reverse proxy, attackers could appear to come from loopback. The fix is 2.2.0 or later.

Hot take: "It came from localhost, so it's trusted" has never been safe behind a proxy, and it's an especially bad idea on a box full of GPUs and cloud keys. If you run any AI serving stack behind Nginx or Traefik, check how it decides who is local.

6. Anthropic Lets You Self-Host Its Agent Infrastructure

Anthropic opened a private beta of self-hosted Claude Managed Agents. Customers can run the agent harness, sandboxes, credentials and session history in their own cloud or data center, with PostgreSQL storing the history. The model itself still runs outside your network.

Hot take: This is a closed product, not open source, but the direction matters for anyone who reads this blog. Agent session history and credentials are sensitive enough that a major AI vendor now lets you keep them in-house. The control points are familiar ones: a host allowlist, credentials held outside the sandbox, and every tool call logged.

7. The Patch List: Gogs, OpenProject and More

Gogs shipped four releases in one day, together fixing dozens of advisories. OpenProject fixed a critical (CVSS 9.4) flaw that let anyone who could view a project, including anonymous visitors on public instances, trigger operations such as deleting it.

Hot take: That many fixes landing on a single day is a lot to absorb. If you still run Gogs, upgrade, and then ask whether its release pace fits a service that holds your code.

8. Rocket.Chat 9.0 Moves Custom OAuth Behind a Licence

Not a CVE, but a change that can lock people out. Rocket.Chat 9.0 makes Custom OAuth a Premium feature. On workspaces without that licence, Custom OAuth logins are refused after the upgrade. Built-in providers such as Google and GitHub keep working. Webhook scripts also lost their Babel step and now run in strict mode, and MongoDB 8.0 is required.

Hot take: If your team signs in to Rocket.Chat through Keycloak or Authentik with Custom OAuth, don't upgrade until you've decided what to do about login. Moving an existing self-hosted feature behind a paywall in a major version is the kind of change that makes people look at alternatives.

What We're Watching Next Week

PostgreSQL 19 is planned for general availability on November 19, and RC 2 reverted some JSON features, so check anything you built on the release candidates. We're also watching whether wfx-loot spreads further, and how many Alpine images still ship a vulnerable sshd.

The Bottom Line

Three of this week's biggest stories share a shape: SSHole trusted an asterisk, GPUStack trusted localhost, and wfx-loot relied on long-lived CI secrets. Each one is a trust assumption that held right up until someone tested it.

Patch OpenSSH on Alpine, PostgreSQL (server and clients) and OpenProject today, and audit your CI for wfx-loot's fingerprints.

If keeping up with that list is the part you'd rather not do by hand, that's what Elestio's managed deployments handle: automated updates, backups and monitoring on infrastructure you still own.

Thanks for reading ❤️ See you next week 👋