Description
Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access and execute commands as root. middlewared registers the HA peer-authentication hook (ha_permission) unconditionally, with no failover-licence or heartbeat-interface check. An unauthenticated connection whose TCP peer address is a hardcoded HA heartbeat address (169.254.10.1 or 169.254.10.2) and whose peer port is <= 1024 is granted a node credential that is authorized for every API method and treated as full administrator. Both conditions are properties of the attacker's own socket, and thus an attacker on the same layer-2 segment satisfies them without forging anything. The hook is present on non-HA, unlicensed, single-node Community Edition installations. The fix additionally requires that the connection terminate on the HA heartbeat listener (a local address/port the attacker cannot control).
Published: 2026-11-05
Score: 8.3 High
EPSS: n/a
KEV: No
Impact: Authentication Bypass
Action: Apply Patch
AI Analysis

Impact

This vulnerability is an authentication bypass flaw in the HA heartbeat origin check of TrueNAS SCALE’s middlewared component. The failure allows an attacker who can reach the system on the same layer‑2 segment to create an unauthenticated connection from the hard‑coded HA heartbeat IP addresses (169.254.10.1 or 169.254.10.2) with a TCP peer port below 1024. The middlewared service then grants the connection a full‑administrator node credential and permits execution of any API command as root, directly compromising the host’s confidentiality, integrity and availability. This weakness is classified as CWE‑290.

Affected Systems

The flaw affects TrueNAS SCALE deployments running any release before 25.10.8, including earlier release trains that had not yet applied the fix. It is present in both HA and non‑HA builds, including the unlicensed Community Edition, because the HA peer‑authentication hook is registered unconditionally.

Risk and Exploitability

The CVSS base score is 8.3, indicating a high‑severity vulnerability. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of this analysis. The attack vector is local network; an attacker needs only to be on the same layer‑2 segment and connect to the HA heartbeat IP addresses. No special privileges or additional compromised accounts are required to exploit the flaw.

Generated by OpenCVE AI on November 5, 2026 at 08:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade TrueNAS SCALE to version 25.10.8 or later, which implements a mandatory HA heartbeat listener check that restricts node credential issuance to the local HA listener address.
  • If upgrading is not immediately possible, isolate or block traffic to the 169.254.10.0/24 subnet on all interfaces to prevent remote connections from the local network layer.
  • For non‑HA or unlicensed Community Edition installations that use HA peer‑authentication hooks, disable HA support or reconfigure the middlewared service to refuse connections on the HA heartbeat addresses.

Generated by OpenCVE AI on November 5, 2026 at 08:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 05 Nov 2026 08:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in TrueNAS SCALE HA Heartbeat Origin Check

Thu, 05 Nov 2026 07:15:00 +0000

Type Values Removed Values Added
Description Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access and execute commands as root. middlewared registers the HA peer-authentication hook (ha_permission) unconditionally, with no failover-licence or heartbeat-interface check. An unauthenticated connection whose TCP peer address is a hardcoded HA heartbeat address (169.254.10.1 or 169.254.10.2) and whose peer port is <= 1024 is granted a node credential that is authorized for every API method and treated as full administrator. Both conditions are properties of the attacker's own socket, and thus an attacker on the same layer-2 segment satisfies them without forging anything. The hook is present on non-HA, unlicensed, single-node Community Edition installations. The fix additionally requires that the connection terminate on the HA heartbeat listener (a local address/port the attacker cannot control).
Weaknesses CWE-290
References
Metrics cvssV3_1

{'score': 8.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-11-05T06:58:31.785Z

Reserved: 2026-11-05T06:58:31.365Z

Link: CVE-2026-123033

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-05T07:17:26.207

Modified: 2026-11-05T07:17:26.207

Link: CVE-2026-123033

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-05T08:30:14Z

Weaknesses
  • CWE-290

    Authentication Bypass by Spoofing