Authentication Bypass Vulnerability in TrueNAS SCALE Middleware

CVE-2026-123033

What is CVE-2026-123033?

TrueNAS SCALE prior to version 25.10.8 contains a vulnerability in its middleware component that allows attackers on the same network segment to bypass authentication. This vulnerability arises due to improper checks in the HA heartbeat origin check, granting unauthorized users full-administrator API access. An attacker can leverage a connection originating from a predefined HA heartbeat IP address to exploit this flaw, leading to potential execution of commands with root privileges. The issue affects HA and single-node Community Edition installations, highlighting the necessity for robust network security and timely updates.

References