Unraid Authentifizierungs-Request Pfad-Traversal Authentifizierungs-Umgehung Schwachstelle

The primary impact of CVE-2026-3839 is the ability for an attacker to bypass authentication entirely. This means an attacker can access Unraid's web interface and potentially execute commands without providing valid credentials. Successful exploitation could lead to data breaches, system compromise, and the installation of malicious software. The blast radius extends to any data stored on the Unraid NAS, including personal files, media libraries, and potentially sensitive business data. This vulnerability shares similarities with other authentication bypass flaws where lack of input validation allows attackers to manipulate paths and gain unauthorized access.

Organizations and individuals utilizing Unraid NAS devices, particularly those with exposed web interfaces or limited network segmentation, are at risk. Shared hosting environments where multiple users share an Unraid server are especially vulnerable, as a compromise of one user's account could potentially lead to broader system access.

• linux / server:

journalctl -u unraid | grep -i "auth-request.php"

• linux / server:

ps aux | grep -i "unraid"

• generic web: Use curl to test the /auth-request.php endpoint with various path traversal payloads (e.g., ../etc/passwd).

curl http://<unraid_ip>/auth-request.php?file=../../../../etc/passwd

1. 2026-03-13Disclosure

   disclosure

1. Reserviert2026-03-09
2. Veröffentlicht2026-03-13
3. Geändert2026-03-16
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-3839 is to upgrade to a patched version of Unraid as soon as it becomes available. Until the upgrade is possible, consider implementing temporary workarounds to reduce the attack surface. Restricting network access to the Unraid NAS by limiting inbound connections to only necessary ports can help. Closely monitor authentication logs for suspicious activity, such as unusual login attempts or access patterns. Implement a Web Application Firewall (WAF) to filter malicious requests targeting the authentication endpoint. While a specific Sigma or YARA rule may not be available, generic rules for path traversal attempts can be applied.