# TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033) · pwn.watch > TrueNAS says its middleware (middlewared) in TrueNAS SCALE, Community Edition and Enterprise, trusted any API connection whose source address was one of the hardcoded HA heartbeat addresses (169.254.10.1 or 169.254.10.2) and whose source port was 1024 or lower, and handed it an internal node credential that counts as full administrator for every API method. The hook is registered on every install, including single-node Community Edition systems with no HA set up. Admin API access can be used to run commands as root, bypasses the management IP allowlist and rate limiting, and isn't recorded in the audit log. It can't be exploited from the internet: the attacker has to be on the same layer-2 segment as the management interface (for example a VM on the same hypervisor switch or a host on a flat VLAN) and also has to control the return path, since TrueNAS has no route to 169.254.0.0/16. TrueNAS rates it CVSS 3.1 8.3 (high). The fix ships in TrueNAS SCALE 25.10.8, which TrueNAS describes as forthcoming; until then the mitigation is keeping the management interface on a dedicated, trusted network. TrueNAS CORE is not affected. No exploitation has been reported. Page: https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: high · status: live · patch: unpatched - Product: TrueNAS SCALE (Community Edition and Enterprise) - Started: 2026-11-05 - CVEs: CVE-2026-123033 - Affected: TrueNAS SCALE before 25.10.8 (and other release trains before their fixes) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033/feed.xml - JSON Feed: https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033.json - This file: https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033/llms.txt ## Updates (newest first) - 2026-11-05: TrueNAS publishes an impact statement: the HA peer-authentication hook in middlewared trusts the connection's source address and port alone and is present on single-node Community Edition installs too; the fix is in the forthcoming TrueNAS SCALE 25.10.8, and the interim mitigation is an isolated management network. Credit goes to spnctf. (https://security.truenas.com/scale/impact-statements/ha-node-auth-bypass/) - 2026-11-05: CVE-2026-123033 is published for the bug, rated CVSS 3.1 8.3 (adjacent network, high attack complexity, no privileges needed). (https://www.cve.org/CVERecord?id=CVE-2026-123033) ## Fix brief # Security brief: TrueNAS SCALE: HA heartbeat check grants root-level admin API access to a nearby attacker (CVE-2026-123033) Source: https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033 · status: live · severity: high · updated Nov 5, 2026, 07:31 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is TrueNAS says its middleware (middlewared) in TrueNAS SCALE, Community Edition and Enterprise, trusted any API connection whose source address was one of the hardcoded HA heartbeat addresses (169.254.10.1 or 169.254.10.2) and whose source port was 1024 or lower, and handed it an internal node credential that counts as full administrator for every API method. The hook is registered on every install, including single-node Community Edition systems with no HA set up. Admin API access can be used to run commands as root, bypasses the management IP allowlist and rate limiting, and isn't recorded in the audit log. It can't be exploited from the internet: the attacker has to be on the same layer-2 segment as the management interface (for example a VM on the same hypervisor switch or a host on a flat VLAN) and also has to control the return path, since TrueNAS has no route to 169.254.0.0/16. TrueNAS rates it CVSS 3.1 8.3 (high). The fix ships in TrueNAS SCALE 25.10.8, which TrueNAS describes as forthcoming; until then the mitigation is keeping the management interface on a dedicated, trusted network. TrueNAS CORE is not affected. No exploitation has been reported. Severity detail: Unauthenticated admin API access and root command execution, but only from the same layer-2 segment with control of the return path; CVSS 3.1 8.3 (high) per TrueNAS; no exploitation reported - Product: TrueNAS SCALE (Community Edition and Enterprise) - CVE / advisory ids: CVE-2026-123033 ## Affected versions - TrueNAS SCALE before 25.10.8 (and other release trains before their fixes) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you run TrueNAS SCALE: make sure no untrusted VM or host shares the management interface's layer-2 segment (isolate hypervisor virtual switches and management VLANs), and update to TrueNAS SCALE 25.10.8 or later as soon as it is released. TrueNAS CORE users are not affected. ## Latest updates - Nov 5, 2026: TrueNAS publishes an impact statement: the HA peer-authentication hook in middlewared trusts the connection's source address and port alone and is present on single-node Community Edition installs too; the fix is in the forthcoming TrueNAS SCALE 25.10.8, and the interim mitigation is an isolated management network. Credit goes to spnctf. - Nov 5, 2026: CVE-2026-123033 is published for the bug, rated CVSS 3.1 8.3 (adjacent network, high attack complexity, no privileges needed). ## Advisories - [HA Heartbeat-Origin Authentication Bypass](https://security.truenas.com/scale/impact-statements/ha-node-auth-bypass/) (TrueNAS Security) - [CVE-2026-123033](https://www.cve.org/CVERecord?id=CVE-2026-123033) (CVE Program (MITRE)) ## Caveats TrueNAS says the advisory will be updated as fixed releases become available for each train. --- Machine-readable: https://pwn.watch/i/truenas-scale-ha-heartbeat-auth-bypass-cve-2026-123033.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.