Unraid 7.0.0 Tailscale Localhost Auth Bypass (CVE-2025-29266)

Key Information Vulnerability Overview CVE ID: CVE-2025-29266 Summary: Unraid 7.0.0 allows remote users, when "Host" network mode is used and "Use Tailscale" is enabled, to access the Unraid WebGUI and Web console as root without authentication. Any user connected via the resulting Tailscale device can access the WebGUI by opening a browser and navigating to the WebGUI port. Vulnerability Details CVSS v4.0: 7.7 / High (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) CVSS v3.1: 8.8 / High (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE: CWE-291: Reliance on IP Address for Authentication Description: The Unraid WebGUI allows connections from localhost to bypass authentication and connect with root privileges. When this feature is enabled on containers using host network mode, Unraid interprets the traffic as originating from localhost, thereby bypassing authentication. Any user who can connect to the port via the Tailscale device can thus access the WebGUI and shell (via the built-in web terminal). Affected Products/Versions Unraid: 7.0.0 Fixed Versions Unraid: >= 7.0.1 Solutions/Mitigations Disable "Use Tailscale" on containers using "Host" network mode. Use Tailscale ACLs to prevent access to the WebGUI port via Tailscale devices created for containers. Comment out or remove the following lines in the nginx configuration to disable the localhost authentication bypass, then restart nginx: Warning is replaced on every boot; any modifications to the file must be reapplied after each server restart. References Unraid 7.0.1 Release Notes

Goal Reached Thanks to every supporter — we hit 100%!

Unraid 7.0.0 Tailscale Localhost Auth Bypass (CVE-2025-29266)