The Unraid Authentication Request Path Traversal Authentication Bypass Vulnerability (CVE-2026-3839) is caused by insufficient validation of a user-supplied path in the auth-request.php file. This allows remote attackers to bypass authentication mechanisms entirely, gaining unauthorized access to the system. The vulnerability was reported to the vendor on February 17, 2026, and publicly disclosed on March 9, 2026. The vendor addressed the issue by releasing a fixed version 7.2.4 of Unraid. The vulnerability has a CVSS v3 base score of 7.3, reflecting its network attack vector, low attack complexity, no required privileges or user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation results in authentication bypass, allowing remote attackers to gain unauthorized access to affected Unraid systems. This can lead to potential compromise of system confidentiality, integrity, and availability. No known active exploitation has been reported at the time of disclosure.

Apply the official fix by upgrading Unraid to version 7.2.4 or later. This update addresses the path traversal validation flaw in auth-request.php and mitigates the authentication bypass vulnerability. No additional mitigations are specified or required once the patch is applied.