CVE-2026-31881 is an authentication gap in Runtipi, the personal homeserver orchestrator, scored 7.7 by NVD. While a password reset request is active, any remote user can set a new operator password and log in as admin. Upgrade to Runtipi 4.8.0 or later.
What's affected
Runtipi 4.7.2 and earlier, per the GitHub advisory. The fixed version is 4.8.0.
The weak spot only opens while a password reset request is active. The advisory describes a 15 minute window. If nobody has requested a reset, the window is closed, but you cannot count on that for an instance that faces the internet.
How to check if you're exposed
Check the version shown in your Runtipi dashboard or the image tag you deploy. If you run it from the command line, compare your release against 4.8.0.
Then ask whether the instance is reachable from outside your home or office network. A Runtipi dashboard published to the internet is the case that matters here. Also review your admin account for any password change or login you do not recognize.
What to do now
- Upgrade Runtipi to 4.8.0 or later.
- If you did not start a password reset recently but your admin password no longer works, treat the instance as compromised and rebuild credentials.
- Keep the dashboard behind a VPN or other access layer instead of exposing it directly.
- Review installed apps and their settings, since an admin session can change them.
Why it matters
The class is CWE-306, missing authentication for a critical function. The reset endpoint did not check who was calling it, only whether a reset window was open. The advisory also says the status endpoint was open, so an outsider could tell when a window was active.
The outcome is full takeover of the operator account. The advisory adds that the password change disabled two factor settings and ended all sessions, which would lock the real owner out.
Homeserver tools are often run by one person with no monitoring. That makes a quiet takeover more likely to go unnoticed. Updating and keeping the admin panel off the open internet are the two cheap defenses.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Am I only at risk during a reset?
The advisory says the gap exists when a password reset request is active, for 15 minutes. Upgrade anyway, since you cannot know when someone else might see that window.
Should I change my password after upgrading?
If you saw any unexpected password change or session loss, yes. Otherwise it is sensible to rotate it once as a precaution.
Sources
Last reviewed: 19 October 2026.
