Monday digest, 19 October: Homepage v2.6.0 brings security fixes and authentication refactoring
This week highlights several critical vulnerabilities affecting core management and automation tools such as n8n, Wazuh, OpenSSH and WinBox for MikroTik. On the other hand, Homepage receives security fixes and the Terraform provider for Proxmox introduces support for custom CPU models.
- Docker
- JavaScript / TypeScript
- Linux / SSH hardening
- Linux (Debian, Alpine, Arch)
- Wazuh
- MikroTik
- Terraform
- Proxmox VE
Homepage v2.6.0 brings security fixes and authentication refactoring
Homepage v2.6.0 has been released, resolving security advisory GHSA-qxcr-4rv3-v23r, refactoring the authentication architecture, and fixing dollar sequence handling in environment and file secrets.
On my server: It is a relevant update for the dashboard used to group homelab service links, as it addresses a security flaw and improves secret handling.
- Idea: Read the v2.6.0 release notes to check the security fix and verify authentication changes.
- v2.6.0 · Homepage ↗
Security · Multiple high-severity vulnerabilities identified in n8n
Several vulnerabilities have been discovered in n8n ranging from SQL injection and prototype pollution to disk exhaustion and code execution in the Git node.
Why it matters: An unauthenticated attacker could exhaust disk space or execute arbitrary SQL, while a user with limited permissions could take over accounts or run commands with the automation engine process privileges.
- Idea: Fixed in versions 1.123.83, 2.41.4, and 2.42.1 depending on the branch used.
Security · Vulnerabilities in OpenSSH, SFTP, and Fail2ban filters
Several vulnerabilities have been discovered affecting OpenSSH and associated tools, including a flaw in the SFTP client and log manipulation in Fail2ban.
Why it matters: A malicious SFTP server could write files outside the selected directory during a copy operation, whilst an unauthenticated attacker could manipulate sshd logs to cause Fail2ban to ban legitimate IP addresses.
Security · Multiple vulnerabilities in Wazuh allow RCE and authentication bypass
Several vulnerabilities have been disclosed in Wazuh versions prior to 4.14.8, covering path traversal, authentication bypass, and remote code execution flaws.
Why it matters: An attacker or a compromised worker/agent could delete or overwrite critical system files, bypass authentication to take over the superuser account, or execute commands as root on monitoring agents.
- Idea: Fixed in version 4.14.8.
Security · Privilege escalation vulnerability in WinBox for MikroTik RouterOS
An incorrect authorisation vulnerability has been discovered in the WinBox authentication flow in MikroTik RouterOS. An authenticated user with low privileges can obtain a full administrative session without knowing the target account's password.
Why it matters: It enables a user with limited WinBox access credentials to escalate their permissions and gain full administrative control of the network router by supplying a higher-privilege account during the second stage.
- CVE-2026-103903 en MikroTik RouterOS · MikroTik RouterOS ↗
Terraform bpg/proxmox provider release v0.117.0
Version 0.117.0 of the bpg/proxmox Terraform provider has been released. It adds a resource for custom VM CPU models, enables root@pam-only API calls via SSH-minted tickets, and fixes several bugs in LXC cloning, Cloud-Init cleanup, and disk volume handling.
On my server: It provides greater flexibility when declaring virtual machines in code and resolves stability issues when provisioning LXC containers, cloning templates, or maintaining idle connections with pveproxy.
- Idea: Review the release notes before updating the provider in the Terraform configuration if using Cloud-Init templates or custom VM CPU configurations.
- v0.117.0 · Proveedor bpg/proxmox de Terraform ↗