UniFi OS Server Pre-Auth RCE Chain (CVE-2026-34908/34909/34910): x-original-uri Auth-Gateway Bypass + package-update Command Injection — Threadlinqs Intelligence
As of 2026-06-08, UniFi OS Server Pre-Auth RCE Chain (CVE-2026-34908/34909/34910): x-original-uri Auth-Gateway Bypass + package-update Command Injection is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 13 indicators of compromise.
Threat ID: TL-2026-0714 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Bishop Fox disclosed a weaponized, unauthenticated end-to-end root RCE chain against Ubiquiti UniFi OS Server. An Nginx auth-gateway bypass (CVE-2026-34908/34909) abuses the mismatch between the raw
Bishop Fox published a full pre-authentication remote code execution chain against Ubiquiti UniFi OS Server that combines an authentication-gateway bypass with a command injection in the package-update service, resulting in unauthenticated root code execution over the network on TCP/11443.
AUTH-GATEWAY BYPASS (CVE-2026-34908 / CVE-2026-34909): UniFi OS fronts its services with an Nginx auth_request gateway. The gateway evaluates the RAW, client-supplied, percent-encoded value of the x-original-uri header to decide whether a path is auth-exempt — any URI beginning with the prefix /api/auth/validate-sso/ is treated as public. Nginx's routing layer, however, dispatches the request using the NORMALIZED $uri (percent-decoded, with traversal segments collapsed). An attacker crafts a request whose raw form starts with the exempt prefix but whose normalized form resolves to an internal authenticated route under /proxy/<service>/. Encoded traversal sequences (..%2f, %2e%2e, ..%2e) drive the divergence: the gate approves while the router targets a protected backend. CVE-2026-34908 is tracked as improper access control (CWE-284) and CVE-2026-34909 as the associated path-traversal/normalization flaw.
COMMAND INJECTION (CVE-2026-34910): The reachable package-update handler (/proxy/users/api/v2/ucs/update/latest_package) builds a shell command with fmt.Sprintf, interpolating the user-controlled package name verbatim (sudo /usr/bin/uos runnable latest-versions %v) and executing it through an sh -c wrapper. Shell metacharacters in the package-name parameter break out of the intended command. The handler runs as the ucs-update service account, which holds passwordless sudo to /usr/bin/dpkg, /bin/chmod, /bin/systemctl and /usr/bin/uos — so an injected `sudo dpkg -i` of an attacker-staged .deb escalates to full root. CVE-2026-34910 is improper input validation (CWE-20). An authenticated variant, CVE-2026-33000 (CVSS 9.1), reaches the same sink with a valid view:identity:update token.
IMPACT: Root on a UniFi OS Server exposes the JWT signing key (/data/unifi-core/config/jwt.yaml — enabling forged admin tokens even after patching), TLS private keys, cloud-access tokens, the PostgreSQL user database, RADIUS secrets, WiFi/VPN credentials, NFC card data, facial-recognition templates, and /etc/shadow hashes. Where UniFi Access/Protect are deployed, this extends to unlocking doors, accessing cameras, enrolling credentials, and manipulating surveillance. Bishop Fox reports roughly 100K instances exposed. Patching to 5.0.8 closes the entry vector but does NOT invalidate an exfiltrated JWT signing key; any instance exposed pre-patch should be treated as compromised, have its signing key rotated, and be rebuilt from known-good media due to the risk of root-level persistence.
Weaknesses (CWE)
CWE-284, CWE-22, CWE-20, CWE-78, CWE-77
Target sectors: technology, managed-service-providers, retail, hospitality, education, healthcare, small-business, enterprise-networking
Target regions: Global, North America, Europe, Asia
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 13 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000, T1595, T1592, T1190, T1133, T1059, T1203, T1505, T1543, T1548, T1068