Unauthenticated Password Reset Vulnerability in Runtipi Homeserver Orchestrator
CVE-2026-31881

7.7HIGH

Key Information:

Vendor

Runtipi

Status
Runtipi
Vendor
CVE Published:
11 March 2026

What is CVE-2026-31881?

Runtipi, a personal homeserver orchestrator, is susceptible to a serious flaw where an unauthenticated attacker can reset the admin password due to inadequate authentication checks on the reset-password endpoint. This vulnerability allows any remote user to exploit a 15-minute password reset window to take control of the admin account. The issue has been addressed in version 4.8.0, making it critical for users to upgrade to this version to mitigate potential security risks.

Affected Version(s)

runtipi < 4.8.0

References

https://github.com/runtipi/runtipi/security/advisories/GH...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.