CVE-2026-73211

CVE-2026-73211 is a SQL injection in PeerTube's ActorFollowModel.updateScore() method, where the attacker-controlled inboxUrl field from federated actor data is interpolated directly into a database query. The vulnerability yields a CVSS 9.8, but the severity justification runs deeper than the injection itself. The critical gap is not the SQLi mechanism but the trust model failure that made interpolating federation data into queries seem reasonable. ActivityPub's protocol design creates a cognitive pressure: mutual federation feels like a relationship, and relationships feel like trust. Developers operating in the fediverse inherit a mental model where federation peers are semantically trusted because the protocol requires agreement to communicate. This is a category error. Protocol-level authentication (HTTPS, signature verification) verifies the source—it does not sanitize the content. PeerTube's model layer appears to have conflated protocol trust with data trust, treating inboxUrl as safe by federation status rather than untrusted input. The blast radius extends beyond the SQL injection. The attacker injects a URL pointing to their own server—this is simultaneously an SQL injection vector and a pointer the server will actively dereference. PeerTube will fetch from that inboxUrl, meaning the exploitation has two simultaneous paths: direct data exfiltration via SQL (including OAuth tokens from the database), and a secondary federated fetch path where attacker-controlled content is processed by the federation handler. A fix that only parameterizes the query without addressing the fetch-and-process path leaves a second-order exploitation window. This pattern is not PeerTube-specific. The same vulnerability class propagated through XMPP implementations a decade ago, where developers reasoned that federated stanza content was trusted because the servers were known. The ActivityPub specification describes inboxUrl as an actor property defining where an actor receives activity—semantic framing that treats it as protocol-native rather than user-supplied. The spec has never contained an explicit caveat that actor properties must be treated as untrusted input. This design framing seeds the same cognitive error in every implementation. Check your fediverse deployments for model-layer methods that iterate over federated actor data and use those fields in database operations without parameterized queries. The ActorFollowModel.updateScore() pattern—bulk federation event processing that bypasses application-level sanitization—is likely replicated in other implementations. The fix in PeerTube 8.1.6 should be audited to confirm it addresses both the SQL interpolation and the federated fetch dereferencing. If your instance exposes any model-layer endpoints processing federation data, treat them as attack surface until verified.

Reviewed through automated stages and approved by a human before publication.