CVE-2025-56798 in Unraid OS
Summary
by MITRE • 08/26/2026
Cross-Site Request Forgery (CSRF) vulnerability in Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier allows remote attackers to escalate privileges via the Unraid authentication cookie's lax same-site policy.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The identified security flaw represents a classic Cross-Site Request Forgery (CSRF) vulnerability within Lime Technology, Inc.'s Unraid operating system, specifically affecting versions 6.12.14 and earlier iterations of the software stack. This vulnerability stems from an insufficient validation mechanism regarding session management tokens, particularly concerning the configuration of the SameSite attribute on authentication cookies issued by the web interface. In a standard secure implementation, modern browsers enforce strict policies that prevent third-party sites from sending authenticated requests to a target domain unless explicitly permitted. However, in this specific instance, the lax same-site policy allows an attacker's malicious webpage or script to trigger state-changing actions within the Unraid administrative console without the user's knowledge or consent, effectively bypassing standard browser-based CSRF protections.
From a technical perspective, the core issue lies in how the application handles session cookies during cross-origin requests. When a user is authenticated with their Unraid instance, an authentication cookie is stored locally. If this cookie lacks a restrictive SameSite policy such as Strict or Lax, it will be automatically included in HTTP requests initiated by other domains. An attacker can craft a malicious webpage containing hidden forms or JavaScript commands that target the internal API endpoints of the Unraid OS. Because the browser attaches the valid authentication cookie to these forged requests, the server interprets them as legitimate actions performed by the authenticated user. This mechanism allows for privilege escalation because administrative functions often rely solely on the presence of this session token rather than requiring additional verification steps like anti-CSRF tokens or re-authentication for sensitive operations.
The operational impact of this vulnerability is severe due to the nature of Unraid OS, which serves as a central hub for managing storage arrays and connected hardware in many home lab and enterprise environments. Successful exploitation enables remote attackers to escalate privileges from an unauthenticated state or lower-privileged user account to that of an administrator. Once elevated access is achieved, the attacker gains full control over the system's configuration. This includes the ability to modify network settings, alter storage pool configurations, install unauthorized plugins or packages, and potentially exfiltrate sensitive data stored on the connected drives. The lack of proper isolation between administrative functions means that a single successful CSRF attack can compromise the integrity and confidentiality of the entire infrastructure managed by Unraid.
This vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as an issue where unauthorized commands are transmitted from a user that the web application trusts. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this exploit technique falls under T1078 Valid Accounts and specifically relates to techniques used for privilege escalation through session manipulation. The failure to implement robust anti-CSRF measures indicates a gap in secure coding practices regarding state-changing operations that modify server-side data based on client-initiated requests without adequate verification of intent.
To mitigate this risk, immediate action is required by upgrading the Unraid OS installation to version 6.12.15 or later, where these authentication cookie policies have been corrected. For environments unable to upgrade immediately, administrators should consider implementing network-level controls such as restricting access to the web interface via IP whitelisting or placing it behind a reverse proxy that enforces strict origin checks and validates Referer headers. Additionally, enabling two-factor authentication adds an extra layer of security by requiring secondary verification for administrative actions, thereby reducing the effectiveness of automated CSRF attacks even if session cookies are compromised. Regular audits of cookie attributes to ensure they include SameSite=Strict or SameSite=Lax settings are essential best practices for maintaining web application integrity across all managed services.