**v8.1.8 Important security upgrade**

[peertube@framapiaf.org]

**v8.1.8 Important security upgrade**

We have learned that the SQL injection vulnerability fixed in v8.1.6 has been exploited at scale since at least May 18, 2026 and so before the v8.1.6 release.

We released a new version that remove all user token access gained before v8.1.6. We also explain the attack in the changelog and the countermeasures taken by this release.

**Please upgrade to v8.1.8 as soon as possible.**

https://github.com/Chocobozzz/PeerTube/releases/tag/v8.1.8

[john_livingston@mamot.fr]

@peertube
What is the first vulnerable version?

[peertube@framapiaf.org]

@John_Livingston All versions < 8.1.6 are vulnerable

[oliviavespera@spacey.space]

@peertube Who's been affected by this and how did you learn about this?

[benjamin@piaille.fr]

@peertube thanks for the transparent and precise report
and the quick and efficient reaction

a pleasure

[shadowwwind@mastodon.social]

@peertube hey @funfacts_de, security release für peertube ^

[peertube@framapiaf.org]

@gunchleoc You can delete existing tokens on /admin/settings/system/runners/registration-tokens-list

If you didn't enable remote runners, you don't need to do this.