Critical · published March 31, 2025
🚨 A remote user can waltz right into the Unraid WebGUI as root – no password needed! 🔥 This vulnerability lurks in Unraid versions 7.0.0 before 7.0.1 under specific conditions, making it a ticking time bomb! Think of the Unraid server like a high-security hotel where the front desk accidentally gives out master keys to anyone wandering in. If a container is running in Host networking mode with Tailscale enabled, it's like leaving the front door wide open for uninvited guests! An attacker could gain full control of the system, accessing sensitive files, altering configurations, or even launching further attacks within the network. This means all your data could be at risk, and your entire server could be compromised!
Think of the Unraid server like a high-security hotel where the front desk accidentally gives out master keys to anyone wandering in. If a container is running in Host networking mode with Tailscale enabled, it's like leaving the front door wide open for uninvited guests! This vulnerability allows remote users to bypass authentication and access the Unraid WebGUI and console as the root user. It is triggered when a container is running in Host networking mode while Tailscale is enabled, opening the door for unauthorized access.
An attacker could gain full control of the system, accessing sensitive files, altering configurations, or even launching further attacks within the network. This means all your data could be at risk, and your entire server could be compromised! Update your Unraid installation to version 7.0.1 immediately to close this critical gap. Additionally, review and adjust your container networking settings to minimize exposure until you've patched. And keep an eye on your server activities for any suspicious entries! You've got this! With these steps, you'll secure your Unraid system in no time! 🛡️