Threats tagged 'ghsa-m6c5-5946-f5rx'

A vulnerability in TrueNAS SCALE middlewared before version 25.10.8 allows an attacker on the same network segment to bypass authentication and gain full administrator API access. The flaw arises from the HA heartbeat origin check, which grants node credentials to unauthenticated connections from specific hardcoded IP addresses and ports. This enables execution of commands as root without proper authorization. The issue affects both HA and non-HA Community Edition installations. The fix requires connections to terminate on the HA heartbeat listener, which attackers cannot control.