TrueNAS SCALE: Authentication Bypass by Spoofing
CVE-2026-123033 is a high-severity authentication bypass by spoofing vulnerability in TrueNAS SCALE from iXsystems, with a CVSS 3.1 base score of 8.3 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists version 25.10.8 as the first without the flaw, so updating TrueNAS SCALE to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.44% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update TrueNAS SCALE to 25.10.8 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| iXsystems | TrueNAS SCALE | before 25.10.8 | 25.10.8 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- AdjacentThe attacker must be on the same local network segment.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. Scored by CNA (mitre.org).
Official description
Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access and execute commands as root. middlewared registers the HA peer-authentication hook (ha_permission) unconditionally, with no failover-licence or heartbeat-interface check. An unauthenticated connection whose TCP peer address is a hardcoded HA heartbeat address (169.254.10.1 or 169.254.10.2) and whose peer port is <= 1024 is granted a node credential that is authorized for every API method and treated as full administrator. Both conditions are properties of the attacker's own socket, and thus an attacker on the same layer-2 segment satisfies them without forging anything. The hook is present on non-HA, unlicensed, single-node Community Edition installations. The fix additionally requires that the connection terminate on the HA heartbeat listener (a local address/port the attacker cannot control).
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
More Authentication Bypass by Spoofing vulnerabilities (CWE-290)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Recent Authentication Bypass by Spoofing vulnerabilities
- 9.1 Critical severity
- 8.8 High severity
- 9.8 Critical severity
- 8.1 High severity
- 7.7 High severity
- 9.3 Critical severity
Spotted an error? Tell us.