High severity · published Mar 13, 2026
CVE-2026-3839
Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability
7.3
CVSS
0.7%
EPSS
No
On KEV
Description
Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the auth-request.php file. The issue results from the lack of proper validation of a user-supplied path prior to using it in authentications. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28912.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UN
Unraid · Unraid
7.2.3 · source: vendor, NVD
In the news
VulnerabilityHigh
ZDI-26-172: Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Unraid. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-3839.
Mar 9, 2026·Zero Day Initiative
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-3839
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-3839
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-26-172/
More from Unraid
9.8
CVE-2020-5847
Unraid Remote Code Execution Vulnerability
7.5
CVE-2020-5849
Unraid Authentication Bypass Vulnerability
8.8
CVE-2026-9773
Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability
8.8
CVE-2026-9772
Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability
8.8
CVE-2026-3838
Unraid Update Request Path Traversal Remote Code Execution Vulnerability