WhatBrokeToday
Today's Trends
highInvestigating

SourceHut Disabled Registration Bypass (CVE-2026-121728)

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

SourceHut experienced a security incident involving a vulnerability (CVE-2026-121728) that allowed a registration bypass even when registrations were disabled.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Technical root cause

Under active investigation. No report has identified a root cause yet.

Evidence

1 report · 1 LobstersShow
  1. [1]
    Lobsters First report
    SourceHut disabled registration bypass | CVE-2026-121728(opens Lobste.rs thread in a new tab)

    by mhm 54upvotes 1comments

Timeline

  1. First report on Lobste.rs thread

    SourceHut disabled registration bypass | CVE-2026-121728

    Source