UniFi OS Server Pre-Auth RCE Chain (CVE-2026-34908/34909/34910): x-original-uri Auth-Gateway Bypass + package-update Command Injection
UniFi OS Server Pre-Auth RCE Chain (TL-2026-0714), also tracked as UniFi OS Server Pre-Auth RCE Chain, is a critical-severity software vulnerability scored CVSS 10, first published 2026-06-08. It has no confirmed attribution, affects Ubiquiti UniFi OS Server, references 4 CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), maps to 18 MITRE ATT&CK techniques (T1003, T1005, T1046), and is covered by 9 detection rules and 13 indicators of compromise.
Key facts for TL-2026-0714
- Threat ID
- TL-2026-0714
- Also known as
- UniFi OS Server Pre-Auth RCE Chain, Bishop Fox UniFi RCE
- Severity
- CRITICAL
- CVSS
- 10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-08
- Last reviewed
- 2026-06-08
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, managed-service-providers, retail, hospitality, education, healthcare, small-business, enterprise-networking
- Target regions
- Global, North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in UniFi OS Server Pre-Auth RCE Chain
Malware and tooling: BishopFox/CVE-2026-34908-check
Bishop Fox disclosed a weaponized, unauthenticated end-to-end root RCE chain against Ubiquiti UniFi OS Server. An Nginx auth-gateway bypass (CVE-2026-34908/34909) abuses the mismatch between the raw percent-encoded URI used for auth-exemption checks and the normalized URI used for upstream routing, reaching internal authenticated routes by prefixing an auth-exempt path. That chains into a command injection in the package-update service (CVE-2026-34910) that interpolates a user-supplied package name into a shell string executed via sh -c, yielding root-level RCE.
How UniFi OS Server Pre-Auth RCE Chain works
Bishop Fox published a full pre-authentication remote code execution chain against Ubiquiti UniFi OS Server that combines an authentication-gateway bypass with a command injection in the package-update service, resulting in unauthenticated root code execution over the network on TCP/11443.
AUTH-GATEWAY BYPASS (CVE-2026-34908 / CVE-2026-34909): UniFi OS fronts its services with an Nginx auth_request gateway. The gateway evaluates the RAW, client-supplied, percent-encoded value of the x-original-uri header to decide whether a path is auth-exempt — any URI beginning with the prefix /api/auth/validate-sso/ is treated as public. Nginx's routing layer, however, dispatches the request using the NORMALIZED $uri (percent-decoded, with traversal segments collapsed). An attacker crafts a request whose raw form starts with the exempt prefix but whose normalized form resolves to an internal authenticated route under /proxy/<service>/. Encoded traversal sequences (..%2f, %2e%2e, ..%2e) drive the divergence: the gate approves while the router targets a protected backend. CVE-2026-34908 is tracked as improper access control (CWE-284) and CVE-2026-34909 as the associated path-traversal/normalization flaw.
COMMAND INJECTION (CVE-2026-34910): The reachable package-update handler (/proxy/users/api/v2/ucs/update/latest_package) builds a shell command with fmt.Sprintf, interpolating the user-controlled package name verbatim (sudo /usr/bin/uos runnable latest-versions %v) and executing it through an sh -c wrapper. Shell metacharacters in the package-name parameter break out of the intended command. The handler runs as the ucs-update service account, which holds passwordless sudo to /usr/bin/dpkg, /bin/chmod, /bin/systemctl and /usr/bin/uos — so an injected `sudo dpkg -i` of an attacker-staged .deb escalates to full root. CVE-2026-34910 is improper input validation (CWE-20). An authenticated variant, CVE-2026-33000 (CVSS 9.1), reaches the same sink with a valid view:identity:update token.
IMPACT: Root on a UniFi OS Server exposes the JWT signing key (/data/unifi-core/config/jwt.yaml — enabling forged admin tokens even after patching), TLS private keys, cloud-access tokens, the PostgreSQL user database, RADIUS secrets, WiFi/VPN credentials, NFC card data, facial-recognition templates, and /etc/shadow hashes. Where UniFi Access/Protect are deployed, this extends to unlocking doors, accessing cameras, enrolling credentials, and manipulating surveillance. Bishop Fox reports roughly 100K instances exposed. Patching to 5.0.8 closes the entry vector but does NOT invalidate an exfiltrated JWT signing key; any instance exposed pre-patch should be treated as compromised, have its signing key rotated, and be rebuilt from known-good media due to the risk of root-level persistence.
MITRE ATT&CK techniques used in TL-2026-0714
Credential Access
T1003 OS Credential Dumping; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Collection
Discovery
T1046 Network Service Discovery
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Defense Evasion
T1211 Exploitation for Stealth
Persistence
T1505 Server Software Component; T1543 Create or Modify System Process
Impact
Reconnaissance
T1592 Gather Victim Host Information; T1595 Active Scanning
defense-impairment
Affected products and versions in UniFi OS Server Pre-Auth RCE Chain
- Ubiquiti — UniFi OS Server
Vulnerable versions: <= 5.0.6 (unifi-core 5.0.126)
Fixed in: 5.0.8 (unifi-core 5.0.153) - Ubiquiti — Cloud Gateways / Dream Machines / NVR
Vulnerable versions: < 5.1.12
Fixed in: 5.1.12 - Ubiquiti — UNAS
Vulnerable versions: < 5.1.10
Fixed in: 5.1.10 - Ubiquiti — Dream Machine Beast
Vulnerable versions: < 5.1.11
Fixed in: 5.1.11 - Ubiquiti — UniFi Express
Vulnerable versions: < 4.0.14
Fixed in: 4.0.14
Remediation for UniFi OS Server Pre-Auth RCE Chain
Patches
- UniFi OS Server 5.0.8 (unifi-core 5.0.153)
- Ubiquiti Security Advisory Bulletin 064 (2026-05-21)
Immediate actions
- Upgrade UniFi OS Server to 5.0.8+ (unifi-core 5.0.153) immediately
- Upgrade hardware appliances: Cloud Gateways/Dream Machines/NVRs to 5.1.12+, UNAS to 5.1.10+, Dream Machine Beast to 5.1.11+, UniFi Express to 4.0.14+
- Restrict TCP/11443 management exposure; remove UniFi OS Server from direct internet exposure
- Hunt for the bypass+injection request signature in Nginx/proxy logs prior to patching
Workarounds
- Block external access to TCP/11443
- Use the Bishop Fox safe checker (CVE-2026-34908-check) to triage exposure without exploiting
Longer-term hardening
- Treat any pre-patch internet-exposed instance as compromised; rebuild from known-good media rather than rotate-in-place
- Rotate the JWT signing key (/data/unifi-core/config/jwt.yaml) and force a service restart/reboot
- Rotate TLS private keys, cloud-access tokens, RADIUS secrets, and database credentials
- Place management interfaces behind VPN and network segmentation; deploy EDR/behavioral monitoring on appliances where supported
CVEs associated with UniFi OS Server Pre-Auth RCE Chain
CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000
Weaknesses (CWE) in UniFi OS Server Pre-Auth RCE Chain
CWE-284, CWE-22, CWE-20, CWE-78, CWE-77
Timeline of UniFi OS Server Pre-Auth RCE Chain
- Fixed builds released: UniFi OS Server 5.0.8 (unifi-core 5.0.153) and corresponding hardware-appliance versions.
- Ubiquiti publishes Security Advisory Bulletin 064; CVE-2026-34908/34909/34910 and CVE-2026-33000 assigned via HackerOne.
- Roughly 100K UniFi OS Server instances reported exposed on the internet on default TCP/11443.
- Bishop Fox releases the CVE-2026-34908-check safe detection tool demonstrating the auth-gateway bypass request.
- Bishop Fox publishes full technical writeup of the unauthenticated pre-auth root RCE chain with detection analysis.
- Threadlinqs Intelligence publishes full threat analysis, MITRE mapping, IOCs, and detection coverage.
Sources cited for UniFi OS Server Pre-Auth RCE Chain
Threats related to UniFi OS Server Pre-Auth RCE Chain
- Ubiquiti UniFi OS — Three Max-Severity Pre-Auth Vulnerabilities (CVE-2026-34908 / 34909 / 34910) in Security Advisory Bulletin 064
- CISA BOD 26-04: Risk-Based Vulnerability Remediation and CISO Reporting Mandate for FCEB Agencies
- CVE-2026-50746: Critical Unauthenticated Command Injection in Ubiquiti UniFi Connect Application (CVSS 10.0)
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
- F5OS / Traffix SDC Information Disclosure (CVE-2026-46333) — Linux Kernel ptrace/pidfd_getfd Race Condition, Public PoC (CHARON)
- DirtyDecrypt / DirtyCBC — Linux Kernel rxgk Root LPE with Public PoC (CVE-2026-31635)
Detection coverage for TL-2026-0714
As of 2026-06-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0714 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.