Server-Side Request Forgery Vulnerability in UniFi OS Devices
CVE-2026-54401

7.7HIGH

Key Information:

Vendor: Ubiquiti Inc
Status: Unifi Os Server; Dream Machines; Enterprise Fortress Gateway; Dream Wall
Vendor: CVE Published:; 2 July 2026

🔔 Create Ubiquiti Inc Vulnerability Alert

What is CVE-2026-54401?

A vulnerability in UniFi OS allows attackers with low privileges and network access to exploit Server-Side Request Forgery (SSRF), potentially escalating privileges within the system. This could lead to unauthorized access and control of sensitive device functionalities, highlighting the importance of securing UniFi OS installations against such threats.

Affected Version(s)

Cloud Gateways 0 < 5.1.19

Cloud Keys 0 < 5.1.19

Dream Machines 0 < 5.1.19

References

https://community.ui.com/releases/Security-Advisory-Bulle...

CVSS V3.1

Score:

7.7

Severity:

HIGH

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 2, 2026
Vulnerability Reserved
Jun 13, 2026

CVE-2026-54401 Data

JSON