ZDI 2026-03-09

ZDI-26-172: Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability

CVE-2026-3839

Machine-generated analysis · WAYSCloud LLM

The advisory notes that authentication can be bypassed via a path traversal in the authentication request, with no authentication required to exploit.

Context

The affected product is Unraid, a server operating system. The vulnerability is a path traversal in the authentication request that leads to an authentication bypass. The advisory explicitly states the vulnerability can be exploited remotely without authentication. Worth noting the CVSS score is 7.3, indicating moderate severity according to ZDI's rating.

Operator considerations

Check: Identify instances of Unraid that are exposed to untrusted networks.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-3839.

Read the full advisory on ZDI →