Is CVE-2025-56798 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-56798 being exploited in the wild.

How severe is CVE-2025-56798?

High severity, with a CVSS score of 8.8, published 26 August 2026.

Which products and versions are affected?

Lime Technology Unraid 6.12.14 and earlier.

Is there a fix for CVE-2025-56798?

A patch was published on 2025: Vulnerabilities patched by Unraid team; version 6.12.15 or later contains fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-56798 attacked?

It is attacked from the adjacent network or over the network.

Am I affected by CVE-2025-56798?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-56798: Lime Technology Unraid CSRF via lax SameSite cookie policy

CVE-2025-56798 · Severity: high · CVSS 8.8 · Published 2026-08-26

Unraid is a web-managed hypervisor system that stores virtual machines, containers, and data on home and small business servers. A flaw in the authentication cookie configuration allows attackers on the same network to forge requests that chain with cross-site scripting vulnerabilities to gain root access to the entire hypervisor system, compromising all hosted services and data.

Quick answers

Is CVE-2025-56798 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-56798 being exploited in the wild.
How severe is CVE-2025-56798?: High severity, with a CVSS score of 8.8, published 26 August 2026.
Which products and versions are affected?: Lime Technology Unraid 6.12.14 and earlier.
Is there a fix for CVE-2025-56798?: A patch was published on 2025: Vulnerabilities patched by Unraid team; version 6.12.15 or later contains fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-56798 attacked?: It is attacked from the adjacent network or over the network.
Am I affected by CVE-2025-56798?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability stems from the Unraid authentication cookie (unraid_<HEX>) lacking an explicit SameSite attribute, defaulting to Lax mode, which permits the cookie to be sent on top-level navigations initiated by third-party sites. Combined with the absence of an Expires attribute (Session-only), attackers can chain CSRF with reflected and stored XSS vulnerabilities in multiple web UI input fields (device name, share browser path, server/user/folder comments) to trigger malicious JavaScript execution within an authenticated user's browser. An attacker on the local network can craft a drive-by attack leveraging common Unraid hostname patterns, and if a victim visits a malicious website while maintaining an active Unraid session, the attacker can install a malicious plugin that executes arbitrary shell commands with root privileges, achieving persistent code execution and full hypervisor takeover. The Unraid team has patched these vulnerabilities; users should upgrade to version 6.12.15 or later.

Affected products

Lime Technology Unraid 6.12.14 and earlier

Timeline

2025-09-18: disclosed: Public disclosure via ALittleInsecure research blog
2025: patched: Vulnerabilities patched by Unraid team; version 6.12.15 or later contains fixes
2026-08-26: advisory: CVE-2025-56798 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.