Critical UniFi OS bug lets hackers gain root without authentication
Three fixed UniFi OS flaws can be chained to bypass login, run commands, and reach root on affected servers. Bishop Fox says no credentials or user interaction are needed.
Intelligence analysis by GPT-5.4 Mini
Researchers say three patched UniFi OS Server bugs can be chained into an unauthenticated root compromise. Ubiquiti fixed the issues in May, but Bishop Fox says the full attack path still matters for defenders running older versions.
A locked office had three weak spots that, when used together, let an intruder walk past the front desk, sneak into a back room, and then grab the master key. Bishop Fox says that key can control the whole UniFi system, like cameras, doors, and network gear.
Analysis
What happened
BleepingComputer reports that three already fixed UniFi OS Server vulnerabilities can be chained into remote code execution with root privileges and no authentication. The flaws are tracked as CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, and they affect UniFi OS Server 5.0.6 and earlier.
How the chain works
According to the article, CVE-2026-34908 is an access-control problem, CVE-2026-34909 is a path traversal issue, and CVE-2026-34910 is a command-injection bug. Bishop Fox says the first two flaws let an attacker bypass authentication and reach a protected backend endpoint. From there, the command-injection bug can be used to run arbitrary commands.
The researchers say the root cause is a mismatch between request handling layers: authentication checks the raw URI, while Nginx routes based on a normalized URI. That means a request can look harmless to one layer while being routed to a protected path by another.
Why it becomes root
The article says the injected commands do not initially run as root, but the service account has passwordless sudo access to several system binaries. That makes escalation to root trivial once code execution is achieved.
Bishop Fox validated the chain on a live UniFi OS Server 5.0.6 instance, but did not publish a full proof of concept. The firm also released a free detection script that safely probes for the vulnerable path and reports whether a target is vulnerable, patched, unaffected, or inconclusive.
Defender guidance
The script does not confirm prior compromise or persistence. The article says defenders should watch for requests to /api/auth/validate-sso/, calls to ucs/update/latest_package, suspicious child processes under ucs-update, and unexpected sudo commands. Bishop Fox says the chain does not work on UniFi OS Server 5.0.8, so upgrading to that release or later is the recommended fix.
Key points
- Three UniFi OS Server vulnerabilities can be chained into unauthenticated root access.
- Bishop Fox validated the attack path on a live UniFi OS Server 5.0.6 system.
- The bypass comes from a mismatch between raw-URI authentication checks and normalized URI routing.
- Ubiquiti fixed the bugs in May, and the chain does not work on UniFi OS Server 5.0.8.
- Bishop Fox released a detection script and suggested looking for suspicious UniFi update and sudo activity.
Ubiquiti has already fixed the flaws, and the article says the chain does not work on UniFi OS Server 5.0.8. Bishop Fox also released a free detection script, which gives defenders a way to check exposure without triggering dangerous commands.
If organizations stay on UniFi OS Server 5.0.6 or earlier, an attacker on the network could gain root without credentials or user interaction. Because the attack does not require failed logins, the article warns that finding past compromise may be difficult, especially if persistence was added.
