Executive brief
Unraid is a web-managed hypervisor system that stores virtual machines, containers, and data on home and small business servers. A flaw in the authentication cookie configuration allows attackers on the same network to forge requests that chain with cross-site scripting vulnerabilities to gain root access to the entire hypervisor system, compromising all hosted services and data.
Technical details
The vulnerability stems from the Unraid authentication cookie (unraid_<HEX>) lacking an explicit SameSite attribute, defaulting to Lax mode, which permits the cookie to be sent on top-level navigations initiated by third-party sites. Combined with the absence of an Expires attribute (Session-only), attackers can chain CSRF with reflected and stored XSS vulnerabilities in multiple web UI input fields (device name, share browser path, server/user/folder comments) to trigger malicious JavaScript execution within an authenticated user's browser. An attacker on the local network can craft a drive-by attack leveraging common Unraid hostname patterns, and if a victim visits a malicious website while maintaining an active Unraid session, the attacker can install a malicious plugin that executes arbitrary shell commands with root privileges, achieving persistent code execution and full hypervisor takeover. The Unraid team has patched these vulnerabilities; users should upgrade to version 6.12.15 or later.
Affected products
- Lime Technology Unraid 6.12.14 and earlier
Timeline
- 2025-09-18: disclosed: Public disclosure via ALittleInsecure research blog
- 2025: patched: Vulnerabilities patched by Unraid team; version 6.12.15 or later contains fixes
- 2026-08-26: advisory: CVE-2025-56798 published