High‑Severity Authentication Bypass in Unraid (CVE‑2026‑3839) Enables Remote Access Without Credentials
What It Is – A path‑traversal flaw in auth-request.php allows remote attackers to bypass authentication on Unraid systems. No credentials are required to exploit the issue.
Exploitability – The vulnerability is publicly disclosed, has a CVSS 7.3 (High) score, and a proof‑of‑concept is available in the advisory. No known active exploit‑as‑a‑service, but the low attack complexity makes exploitation feasible.
Affected Products – Unraid OS (all versions prior to 7.2.4).
TPRM Impact – Organizations that rely on Unraid for on‑premises or hosted storage face unauthorized data access, potential data exfiltration, and downstream supply‑chain risk if the compromised node services other business units or external customers.
Recommended Actions –
- Upgrade all Unraid installations to version 7.2.4 or later immediately.
- Conduct a rapid inventory of Unraid deployments across the enterprise and verify patch status.
- Perform forensic log reviews for signs of unauthenticated access since 2026‑02‑17.
- Apply network segmentation and strict firewall rules to isolate Unraid nodes.
- Update third‑party risk registers to reflect the new vulnerability and reassess any contracts that include Unraid as a service provider.