CVE-2026-123033
Description
A flaw was found in middlewared. An unauthenticated attacker on the same local network segment can bypass authentication by establishing a connection matching high-availability (HA) heartbeat attributes. This improper origin check grants administrative API access, enabling the attacker to execute arbitrary commands with root privileges.
Statement
This vulnerability has been rated as Important because an attacker with adjacent network access can bypass authentication checks to gain full administrative privileges and execute arbitrary commands. However, the middlewared service is specific to TrueNAS SCALE software and is not packaged or distributed in Red Hat Enterprise Linux or any other Red Hat product offerings. As a result, Red Hat products are not affected by this vulnerability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context; Bypass Protection Mechanism
An attacker from an untrusted origin could successfully establish a communication channel. The attacker could then gain privileges and access unexpected functionality that was only intended for trusted sources.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
