diff --git a/CHANGES b/CHANGES
index 721a9618e..d2c79b339 100644
--- a/CHANGES
+++ b/CHANGES
@@ -2177,4 +2177,5 @@
 * eventlog: add logout event
 * mailbox: include alias in mailbox search
 * proxyAuth: add path exclusion
+* turn: fix for CVE-2020-26262
 
diff --git a/src/infra_version.js b/src/infra_version.js
index 3468575cc..262f7b6e2 100644
--- a/src/infra_version.js
+++ b/src/infra_version.js
@@ -15,7 +15,7 @@ exports = module.exports = {
     // a major version bump in the db containers will trigger the restore logic that uses the db dumps
     // docker inspect --format='{{index .RepoDigests 0}}' $IMAGE to get the sha256
     'images': {
-        'turn': { repo: 'cloudron/turn', tag: 'cloudron/turn:1.1.0@sha256:e1dd22aa6eef5beb7339834b200a8bb787ffc2264ce11139857a054108fefb4f' },
+        'turn': { repo: 'cloudron/turn', tag: 'cloudron/turn:1.2.0@sha256:767790bb453f8e5bda56ffa489d1ee9f29b6ee6227b0c241ba2432def2fe1216' },
         'mysql': { repo: 'cloudron/mysql', tag: 'cloudron/mysql:2.3.2@sha256:dd624870c7f8ba9b2759f93ce740d1e092a1ac4b2d6af5007a01b30ad6b316d0' },
         'postgresql': { repo: 'cloudron/postgresql', tag: 'cloudron/postgresql:3.3.0@sha256:0daf1be5320c095077392bf21d247b93ceaddca46c866c17259a335c80d2f357' },
         'mongodb': { repo: 'cloudron/mongodb', tag: 'cloudron/mongodb:3.0.0@sha256:59e50b1f55e433ffdf6d678f8c658812b4119f631db8325572a52ee40d3bc562' },