CVE-2025-29266 | THREATINT

Description

Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.

Reserved 2025-03-11 | Published 2025-03-31 | Updated 2025-03-31 | Assigner mitre

CRITICAL: 9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-289 Authentication Bypass by Alternate Name

Product status

Default status

unaffected

7.0.0 before 7.0.1

affected

References

github.com/unraid/webgui

docs.unraid.net/unraid-os/release-notes/7.0.1/

edac.dev/security/CVE-2025-29266/

cve.org (CVE-2025-29266)

nvd.nist.gov (CVE-2025-29266)

Download JSON