Threats affecting pkg:github/TrueNAS SCALE

CVE-2026-123033 is an authentication bypass vulnerability in the HA heartbeat origin check of middlewared in iXsystems TrueNAS SCALE versions before 25.10.8. An attacker on the same network segment can gain unauthenticated full-administrator API access and execute commands as root by exploiting the unconditional registration of the HA peer-authentication hook. The vulnerability affects even non-HA, unlicensed, single-node Community Edition installations. The issue is fixed in version 25.10.8 by requiring connections to terminate on the HA heartbeat listener, which the attacker cannot control.