TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033)

TrueNAS says its middleware (middlewared) in TrueNAS SCALE, Community Edition and Enterprise, trusted any API connection whose source address was one of the hardcoded HA heartbeat addresses (169.254.10.1 or 169.254.10.2) and whose source port was 1024 or lower, and handed it an internal node credential that counts as full administrator for every API method. The hook is registered on every install, including single-node Community Edition systems with no HA set up. Admin API access can be used to run commands as root, bypasses the management IP allowlist and rate limiting, and isn't recorded in the audit log. It can't be exploited from the internet: the attacker has to be on the same layer-2 segment as the management interface (for example a VM on the same hypervisor switch or a host on a flat VLAN) and also has to control the return path, since TrueNAS has no route to 169.254.0.0/16. TrueNAS rates it CVSS 3.1 8.3 (high). The fix ships in TrueNAS SCALE 25.10.8, which TrueNAS describes as forthcoming; until then the mitigation is keeping the management interface on a dedicated, trusted network. TrueNAS CORE is not affected. No exploitation has been reported.

Why this severity: Unauthenticated admin API access and root command execution, but only from the same layer-2 segment with control of the return path; CVSS 3.1 8.3 (high) per TrueNAS; no exploitation reported

Started

Nov 5, 2026

CVE

CVE-2026-123033

• #Truenas
• #NAS
• Auth bypass
• RCE

Notes & caveats

TrueNAS says the advisory will be updated as fixed releases become available for each train.