{"id":"EM-20261105-APB2","url":"https://cyber.eventmonitor.net/incident/EM-20261105-APB2/truenas-scale-vulnerability-cve-2026-123033/","type":"cve","title":"TrueNAS SCALE Vulnerability (CVE-2026-123033)","subtitle":"CVE-2026-123033","subject":"CVE-2026-123033","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T07:17:26.207Z","firstSignal":"2026-11-05T06:58:31.000Z","lastSignal":"2026-11-05T07:17:26.207Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T07:17:26.207Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T07:17:26.207Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T06:58:31.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T07:17:26.207Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-APB2 created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T07:17:26.207Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T07:17:26.207Z","detail":"CVSS 8.3 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T06:58:31.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T06:58:31.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-123033 (important)","text":"middlewared: middlewared: Authentication bypass via improper HA heartbeat origin check","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-123033.json"},{"at":"2026-11-05T07:17:26.207Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-123033 (CVSS 8.3)","text":"Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access and execute commands as root. middlewared registers the HA peer-authentication hook (ha_permission) unconditionally, with no failover-licence or heartbeat-interface check. An unauthenticated connection whose TCP peer address is a hardcoded HA heartbeat address (169.254.10.1 or 169.254.10.2) and whose peer port is <= 1024 is granted a…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123033"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T07:17:26.207","score":8.3,"severity":"HIGH","desc":"Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access and execute commands as root…","product":"","seen":1793872399796},"kev":null,"epss":{"epss":0.00442,"pct":0.38538,"at":1793967405734},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}