docs.unraid.net
https://docs.unraid.net/unraid-os/release-notes/7.0.1 CVE-2025-29266
CRITICAL
Record summary
CVE-2025-29266 has a selected CVSS score of 9.6 (critical).
Description
Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is running in Host networking mode with Use Tailscale enabled.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 31, 2025 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
UnraidBrowse Unraid / UnraidDefault status: unaffected | CVE List | 7.0.0 to < 7.0.1 | affected |
References
4edac.dev
https://edac.dev/security/CVE-2025-29266 github.com
https://github.com/unraid/webgui nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-29266