PT-2025-13694 · Lime Technology · Unraid

Published 2025-03-31 · Updated 2025-04-04 · CVE-2025-29266

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Unraid versions 7.0.0 through 7.0.0

Description The issue allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled. This can lead to unauthorized root access via the web console.

Recommendations For Unraid version 7.0.0, update to version 7.0.1 immediately to resolve the issue. As a temporary workaround, consider disabling the Use Tailscale feature in Host networking mode until the update is applied. Restrict access to the web console to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-289

Related Identifiers

CVE-2025-29266

Affected Products

Unraid

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-29266 · Security Note
• https://osv.dev/vulnerability/CVE-2025-29266 · Vendor Advisory
• https://github.com/unraid/webgui · Note
• https://twitter.com/cybercronai/status/1906693554853814734 · Twitter Post
• https://twitter.com/cracbot/status/1908112429164195915 · Twitter Post
• https://edac.dev/security/CVE-2025-29266 · Note
• https://twitter.com/CveFindCom/status/1906685790286979536 · Twitter Post
• https://twitter.com/cracbot/status/1907750036907372917 · Twitter Post
• https://docs.unraid.net/unraid-os/release-notes/7.0.1 · Note
• https://twitter.com/CVEnew/status/1906694097785749524 · Twitter Post