Researchers Detail Unauthenticated Root RCE Chain in UniFi OS Server

Jun 8, 2026 · Original article ↗

Summary

Bishop Fox researchers validated a chain of three UniFi OS Server flaws that enables unauthenticated remote code execution and root access. Upgrade to version 5.0.8 or later; a detection script checks vulnerability status but not prior compromise.

Key points

CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910 affect UniFi OS Server versions 5.0.6 and earlier; the flaws were addressed in May.
The first two flaws can bypass authentication and reach a vulnerable endpoint; the third enables command injection through a package-update endpoint.
Researchers traced the authentication bypass to a mismatch between validation of the raw request URI and routing based on its normalized form.
Injected commands run as a privileged service account with passwordless sudo access to several system binaries, enabling escalation to root.
Bishop Fox validated the full chain on a live UniFi OS Server 5.0.6 instance but did not release a working proof of concept.
Bishop Fox's detection script safely checks whether a system is vulnerable, patched, unaffected, or inconclusive; it does not detect past exploitation or persistence.
Upgrade to UniFi OS Server 5.0.8 or later. The article also recommends checking for suspicious requests, child processes, and sudo commands.

Article Details

Attack Vectors: Chain CVE-2026-34908 and CVE-2026-34909 to bypass authentication and reach a protected backend endpoint.
Exploit CVE-2026-34910 at a package-update endpoint to inject commands through unvalidated input.
Use the affected service account's passwordless sudo privileges to escalate command execution to root.
Defensive Notes: Upgrade UniFi OS Server to version 5.0.8 or later; Bishop Fox confirmed the chain does not work on version 5.0.8.
Bishop Fox's detection script safely checks the vulnerable code path but does not identify active or past exploitation, persistence, or backdoors.
Monitor for requests containing '/api/auth/validate-sso/' and requests to 'ucs/update/latest_package,' suspicious child processes under 'ucs-update,' and unexpected sudo commands.
Confirm an updated system has not already been compromised.