Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
NVD: A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
warncomponent_extraction: Component 'UniFi OS nginx auth_request subrequest URI normalization handler' matches or contains product name 'UniFi OS' — no specific component identified
Hunting hypothesis agent
Hunt UniFi OS logs for GET with raw URI at /api/auth/validate-sso/ combined with encoded path-traversal ..%2f, which no legitimate SSO request contains; alert on shell metacharacters in pkg_name on /ucs/update/latest_package.
Research details
ComponentUniFi OS nginx auth_request subrequest URI normalization handler
PreconditionsNetwork reachability to UniFi OS Server web interface (typically TCP 11443) or UniFi OS hardware appliance admin interface; no authentication required; versions at or below 5.0.6 (unifi-core 5.0.126). agent
Deliverycrafted GET request with /api/auth/validate-sso/..%2f path traversal prefix to bypass auth gateway, followed by command injection via pkg_name shell metacharacters in /ucs/update/latest_package endpoint
Exploit notesCVSS 10.0 CRITICAL | CWE-284 improper access control | First link in 3-CVE chain (CVE-2026-34908 bypass, CVE-2026-34909 path traversal, CVE-2026-34910 command injection) | BishopFox published detection-only tool (not weaponized exploit) | Full technical analysis with exploit chain documented | Nginx raw-vs-normalized URI divergence allows auth gateway bypass via /api/auth/validate-sso/..%2f path traversal | Command injection via pkg_name parameter in /ucs/update/latest_package endpoint | Active exploitation confirmed
SummaryUbiquiti UniFi OS improper access control (CWE-284) allows unauthenticated attackers to bypass the nginx auth gateway via raw-vs-normalized URI divergence. The exploit chains with CVE-2026-34909 (path traversal) and CVE-2026-34910 (command injection) to achieve unauthenticated root RCE. BishopFox confirmed the full chain end-to-end on version 5.0.6 and published a detection-only tool.
Tia coverage
First reported2026-06-06
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.