CVE-2026-26078: 
NixOS vulnerability analysis and mitigation

CVE-2026-26078 is an authentication bypass vulnerability in Discourse's Patreon plugin webhook endpoint that allows unauthenticated attackers to forge valid webhook signatures when the patreon_webhook_secret site setting is left blank. Affected versions include all Discourse releases prior to 2025.12.2, versions 2026.1.0 through 2026.1.1 (exclusive), and 2026.2.0-latest prior to the patched 2026.2.0 release. The vulnerability was published on February 26, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is an authorization bypass through a user-controlled key (CWE-639): when the patreon_webhook_secret site setting is blank, Discourse computes webhook signature verification using HMAC-MD5 with an empty string as the key. Because the request body is fully controlled and known to the attacker, they can independently compute the correct HMAC-MD5 signature and craft arbitrary webhook payloads that pass signature validation. No authentication, privileges, or user interaction are required — the attack is conducted entirely over the network with low complexity. The fix rejects all webhook requests when the secret is not configured, eliminating the empty-key forgery vector (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to send arbitrary Patreon webhook payloads to a vulnerable Discourse instance, enabling unauthorized creation, modification, or deletion of Patreon pledge data. Attackers can also trigger unintended patron-to-group synchronization, potentially granting or revoking group memberships for forum users. The integrity impact is rated High, while confidentiality and availability are unaffected — there is no direct data exposure or service disruption, but manipulation of pledge and membership data could have significant downstream consequences for community access control (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). No threat actor attribution has been reported. The EPSS score is approximately 0.028% (0.000280), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication or special privileges and is executable remotely with low complexity, making it straightforward to exploit on misconfigured instances where the webhook secret has never been set.

1. Reconnaissance: Identify Discourse instances with the Patreon plugin enabled and the patreon_webhook_secret setting left blank. This may be inferred from public Discourse forums that advertise Patreon integration.
2. Determine the webhook endpoint: Locate the Patreon webhook receiver endpoint on the target Discourse instance (typically exposed as a configured webhook URL in the Patreon dashboard integration).
3. Craft the forged signature: Compute an HMAC-MD5 hash of the intended webhook request body using an empty string ("") as the key — e.g., in Python: import hmac, hashlib; sig = hmac.new(b'', payload_bytes, hashlib.md5).hexdigest().
4. Send the forged webhook payload: Submit an HTTP POST request to the Discourse Patreon webhook endpoint with the crafted body and the forged HMAC-MD5 signature in the appropriate header, mimicking a legitimate Patreon webhook event.
5. Achieve unauthorized data manipulation: The server accepts the forged request as authentic, allowing the attacker to create, modify, or delete Patreon pledge records, or trigger patron-to-group synchronization to manipulate forum group memberships (GitHub Advisory).

• Network: Unexpected HTTP POST requests to the Discourse Patreon webhook endpoint originating from IP addresses not associated with Patreon's infrastructure; high-frequency or repeated webhook calls from a single source.
• Logs: Discourse application logs showing webhook events processed without a configured patreon_webhook_secret; unexpected pledge creation, modification, or deletion events in Patreon-related log entries; unusual patron-to-group synchronization activity.
• Application Data: Unexpected changes to Patreon pledge records or group memberships in the Discourse database that do not correspond to legitimate Patreon activity; users added to or removed from Patreon-linked groups without corresponding Patreon transactions.

Discourse has released patched versions 2025.12.2, 2026.1.1, and 2026.2.0, which reject webhook requests when the patreon_webhook_secret is not configured. Administrators should upgrade to one of these versions as the primary remediation. As an immediate workaround for those unable to upgrade, configure the patreon_webhook_secret site setting with a strong, non-empty secret value — this prevents signature forgery since the attacker cannot know the secret (GitHub Advisory).

The vulnerability was published by Discourse maintainer davidtaylorhq via a GitHub Security Advisory on February 26, 2026. A brief post was noted on Bluesky referencing the CVE, and security aggregators including Vulners, CVEFeed, and InfinitSec covered the disclosure shortly after publication. No significant broader media coverage or notable researcher commentary beyond standard aggregation has been observed (GitHub Advisory).