Ubiquiti has patched three critical vulnerabilities in UniFi OS Server that chain together to deliver unauthenticated remote code execution with root privileges.
Security researchers at Bishop Fox confirmed the full exploit chain end-to-end on version 5.0.6, turning a single crafted HTTP request into a root shell, no credentials, no user interaction required.
The vulnerabilities are tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, each carrying a CVSS 3.1 score of 10.0. Ubiquiti disclosed all five flaws on May 21, 2026, via Security Advisory Bulletin 064 (SAB-064). Fixes landed in UniFi OS Server 5.0.8 (unifi-core 5.0.153).
Critical UniFi OS Flaws
CVE-2026-34908 / CVE-2026-34909 – Authentication Gateway Bypass: The authentication handler reads the raw, percent-encoded request URI ($request_uri) to decide if a route is publicly exempt.
Nginx, however, selects the upstream backend using the normalized URI ($uri), where %2f decodes to / and ../ sequences collapse.
An attacker crafts a request whose raw form begins with the auth-exempt /api/auth/validate-sso/ prefix passing the gate’s check while its normalized form resolves to an authenticated internal proxy route.
CVE-2026-34910 – Command Injection in Package-Update Service: Behind the gateway sits the package-update handler, which accepts a caller-supplied package name and shells it out via fmt.Sprintf into a command string executed through sh -c.
In version 5.0.6, no validation exists on the package name, so shell metacharacters in the attacker-controlled value are interpreted directly. Reached via the gateway bypass, this becomes an unauthenticated command injection.
The command injection initially executes as the ucs-update service account, but that account holds a passwordless sudo rights over /usr/bin/dpkg, /bin/chmod, /bin/systemctl, and /usr/bin/uos.
Researchers installed a crafted .deb package whose post-install script ran as root, confirming full privilege escalation in a single additional step.
Root on a UniFi OS Server is not root on a generic Linux box. This appliance is the management plane for an organization’s entire network, and in physical deployments, it also includes doors and surveillance cameras.
As root, an attacker can read the JWT signing key, forge persistent admin sessions that survive patching, password resets, and reboots, and exfiltrate TLS private keys, cloud access tokens, the full PostgreSQL user database, etc.
Bishop Fox confirmed that a forged owner-scope JWT token, minted offline from the exfiltrated signing key, authenticated successfully against both a vulnerable 5.0.6 and a fully patched 5.0.8 console.
The patch closes the entry point but leaves the token verification model unchanged, meaning that any signing key stolen before the patch continues to generate valid admin sessions indefinitely.
Where UniFi Access and UniFi Protect are deployed, the same administrative position can unlock physical doors, clone NFC and face credentials, view live camera feeds, and delete recorded surveillance footage. Instances running UniFi OS Server at or below 5.0.6 (unifi-core 5.0.126) are vulnerable.
Hardware appliance owners should consult SAB-064 for per-model fixed versions: most Cloud Gateways and Dream Machines require 5.1.12 or later; the UNAS line requires 5.1.10; the Dream Machine Beast requires 5.1.11; and UniFi Express requires 4.0.14.
Mitigation
- Patch to UniFi OS Server 5.0.8 or the hardware-equivalent fixed version
- Restrict TCP port 11443 to a dedicated management VLAN; block all external access
- Treat any instance exposed before patching as fully compromised, do not rotate-and-hope, rebuild from a known-good image
- Rotate the JWT signing key (
/data/unifi-core/config/jwt.yaml), TLS keys, cloud tokens, RADIUS/WiFi/VPN secrets, and all database credentials, then reboot - Treat biometric and NFC data as permanently disclosed; they cannot be rotated
The Nginx access logs carry a recognizable bypass signature: a request URI containing /api/auth/validate-sso/ alongside encoded path traversal sequences such as ..%2f or %2e%2e.
Additionally, monitor for the package-update route (.../ucs/update/latest_package) with shell metacharacters in parameters, and watch for anomalous sudo dpkg, chmod, or systemctl calls under the ucs-update service account.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
