{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033) · updates",
  "home_page_url": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033",
  "feed_url": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033/feed.json",
  "description": "TrueNAS says its middleware (middlewared) in TrueNAS SCALE, Community Edition and Enterprise, trusted any API connection whose source address was one of the hardcoded HA heartbeat addresses (169.254.10.1 or 169.254.10.2) and whose source port was 1024 or lower, and handed it an internal node credential that counts as full administrator for every API method. The hook is registered on every install, including single-node Community Edition systems with no HA set up. Admin API access can be used to run commands as root, bypasses the management IP allowlist and rate limiting, and isn't recorded in the audit log. It can't be exploited from the internet: the attacker has to be on the same layer-2 segment as the management interface (for example a VM on the same hypervisor switch or a host on a flat VLAN) and also has to control the return path, since TrueNAS has no route to 169.254.0.0/16. TrueNAS rates it CVSS 3.1 8.3 (high). The fix ships in TrueNAS SCALE 25.10.8, which TrueNAS describes as forthcoming; until then the mitigation is keeping the management interface on a dedicated, trusted network. TrueNAS CORE is not affected. No exploitation has been reported.",
  "language": "en",
  "_pwn": {
    "slug": "truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033",
    "severity": "high",
    "status": "live",
    "patchStatus": "unpatched",
    "rss": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033/feed.xml",
    "llms": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033/llms.txt",
    "json": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033#2026-11-05-24742d8c",
      "url": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033#2026-11-05-24742d8c",
      "title": "TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033): TrueNAS publishes an impact statement: the HA peer-authentication hook in middlewared trusts the connection's source address and port alone and is present on single-node Community Edition installs too; the fix is in the forthcoming TrueNAS SCALE 25.10.8, and the interim mitigation is an isolated management network. Credit goes to spnctf.",
      "content_text": "TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033): TrueNAS publishes an impact statement: the HA peer-authentication hook in middlewared trusts the connection's source address and port alone and is present on single-node Community Edition installs too; the fix is in the forthcoming TrueNAS SCALE 25.10.8, and the interim mitigation is an isolated management network. Credit goes to spnctf.\n\nSource: https://security.truenas.com/scale/impact-statements/ha-node-auth-bypass/",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://security.truenas.com/scale/impact-statements/ha-node-auth-bypass/",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033#2026-11-05-3865fe2f",
      "url": "https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033#2026-11-05-3865fe2f",
      "title": "TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033): CVE-2026-123033 is published for the bug, rated CVSS 3.1 8.3 (adjacent network, high attack complexity, no privileges needed).",
      "content_text": "TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033): CVE-2026-123033 is published for the bug, rated CVSS 3.1 8.3 (adjacent network, high attack complexity, no privileges needed).\n\nSource: https://www.cve.org/CVERecord?id=CVE-2026-123033",
      "date_published": "2026-11-05T00:00:00.000Z",
      "external_url": "https://www.cve.org/CVERecord?id=CVE-2026-123033",
      "tags": [
        "high"
      ]
    }
  ]
}