# UniFi OS Server Pre-Auth RCE Chain (CVE-2026-34908/34909/34910): x-original-uri Auth-Gateway Bypass + package-update Command Injection

> Bishop Fox disclosed a weaponized, unauthenticated end-to-end root RCE chain against Ubiquiti UniFi OS Server. An Nginx auth-gateway bypass (CVE-2026-34908/34909) abuses the mismatch between the raw percent-encoded URI used for auth-exemption checks and the normalized URI used for upstream routing, reaching internal authenticated routes by prefixing an auth-exempt path. That chains into a command injection in the package-update service (CVE-2026-34910) that interpolates a user-supplied package name into a shell string executed via sh -c, yielding root-level RCE.

- **Published:** 2026-06-08T00:00:00Z
- **Last reviewed:** 2026-06-08T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0714
- **ID:** TL-2026-0714
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-33000

## Description

Bishop Fox published a full pre-authentication remote code execution chain against Ubiquiti UniFi OS Server that combines an authentication-gateway bypass with a command injection in the package-update service, resulting in unauthenticated root code execution over the network on TCP/11443.

AUTH-GATEWAY BYPASS (CVE-2026-34908 / CVE-2026-34909): UniFi OS fronts its services with an Nginx auth_request gateway. The gateway evaluates the RAW, client-supplied, percent-encoded value of the x-original-uri header to decide whether a path is auth-exempt — any URI beginning with the prefix /api/auth/validate-sso/ is treated as public. Nginx's routing layer, however, dispatches the request using the NORMALIZED $uri (percent-decoded, with traversal segments collapsed). An attacker crafts a request whose raw form starts with the exempt prefix but whose normalized form resolves to an internal authenticated route under /proxy/<service>/. Encoded traversal sequences (..%2f, %2e%2e, ..%2e) drive the divergence: the gate approves while the router targets a protected backend. CVE-2026-34908 is tracked as improper access control (CWE-284) and CVE-2026-34909 as the associated path-traversal/normalization flaw.

COMMAND INJECTION (CVE-2026-34910): The reachable package-update handler (/proxy/users/api/v2/ucs/update/latest_package) builds a shell command with fmt.Sprintf, interpolating the user-controlled package name verbatim (sudo /usr/bin/uos runnable latest-versions %v) and executing it through an sh -c wrapper. Shell metacharacters in the package-name parameter break out of the intended command. The handler runs as the ucs-update service account, which holds passwordless sudo to /usr/bin/dpkg, /bin/chmod, /bin/systemctl and /usr/bin/uos — so an injected `sudo dpkg -i` of an attacker-staged .deb escalates to full root. CVE-2026-34910 is improper input validation (CWE-20). An authenticated variant, CVE-2026-33000 (CVSS 9.1), reaches the same sink with a valid view:identity:update token.

IMPACT: Root on a UniFi OS Server exposes the JWT signing key (/data/unifi-core/config/jwt.yaml — enabling forged admin tokens even after patching), TLS private keys, cloud-access tokens, the PostgreSQL user database, RADIUS secrets, WiFi/VPN credentials, NFC card data, facial-recognition templates, and /etc/shadow hashes. Where UniFi Access/Protect are deployed, this extends to unlocking doors, accessing cameras, enrolling credentials, and manipulating surveillance. Bishop Fox reports roughly 100K instances exposed. Patching to 5.0.8 closes the entry vector but does NOT invalidate an exfiltrated JWT signing key; any instance exposed pre-patch should be treated as compromised, have its signing key rotated, and be rebuilt from known-good media due to the risk of root-level persistence.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1548 Abuse Elevation Control Mechanism
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1565 Data Manipulation

## Sources

- [Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysis](https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis)
- [Bishop Fox CVE-2026-34908-check detection tool](https://github.com/BishopFox/CVE-2026-34908-check)
- [CVE-2026-34908 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-34908)
- [CVE-2026-34910 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-34910)
- [Ubiquiti Security Advisory Bulletin 064](https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b)
- [CVE-2026-34909 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-34909)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0714