--- title: Popping Root on UniFi OS Server: Unauthenticated RCE… description: Bishop Fox details a chained, unauthenticated remote code execution vulnerability in Ubiquiti's UniFi OS Server, combining an Nginx authentication gateway... canonical: https://daily.dev/posts/popping-root-on-unifi-os-server-unauthenticated-rce--q8bfe1sor twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Popping Root on UniFi OS Server: Unauthenticated RCE… | daily.dev og:description: Bishop Fox details a chained, unauthenticated remote code execution vulnerability in Ubiquiti's UniFi OS Server, combining an Nginx authentication gateway... og:url: https://daily.dev/posts/popping-root-on-unifi-os-server-unauthenticated-rce--q8bfe1sor og:image: https://api.daily.dev/og/posts/q8BFe1SoR.png og:image:alt: Popping Root on UniFi OS Server: Unauthenticated RCE… og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Popping Root on UniFi OS Server: Unauthenticated RCE… **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 22 min read · 0 upvotes · 0 comments ## Summary Bishop Fox details a chained, unauthenticated remote code execution vulnerability in Ubiquiti's UniFi OS Server, combining an Nginx authentication gateway bypass (CVE-2026-34908/34909) with a command injection flaw in the package-update service (CVE-2026-34910/33000) to achieve root access from a single unauthenticated request. Root access exposes the JWT signing key, TLS keys, cloud tokens, RADIUS/WiFi/VPN secrets, and biometric data, and in physical deployments can unlock doors and disable security cameras. Patching to UOS 5.0.8+ closes the entry point but does not invalidate already-stolen signing keys, so forged admin tokens keep working post-patch unless secrets are rotated. A free detection tool is provided to safely check exposure without executing commands. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What CVEs are involved in the UniFi OS Server unauthenticated root RCE chain and what version fixes them? The chain combines CVE-2026-34908 and CVE-2026-34909 (authentication gateway bypass, both CVSS 10.0) with CVE-2026-34910 (command injection in the package-update service, also CVSS 10.0). Chained together they yield unauthenticated remote code execution escalating to root. The fix ships in UniFi OS Server 5.0.8 (unifi-core 5.0.153); builds at or below 5.0.6 are affected, and hardware appliances have separate per-model fixed versions. _Track critical CVEs like this UniFi OS chain on daily.dev before they hit your patch queue._ ### Why doesn't patching UniFi OS Server to 5.0.8 fully remediate a prior compromise? Patching closes the exploitation path but does not invalidate a session-token signing key an attacker already stole, since token verification logic is unchanged in 5.0.8. Forged admin tokens minted from that key continue working against patched consoles, surviving reboots, password resets, and the upgrade itself, until the JWT signing key is explicitly rotated and, for confirmed compromises, the console is rebuilt. _Anyone triaging a vendor patch weighs remediation steps like key rotation on daily.dev before declaring an incident closed._ ### What can an attacker do with root access on a UniFi OS Server appliance managing UniFi Access and Protect? Root access grants full administrative control over the network, physical doors, and cameras it manages: an attacker can read every stored secret (JWT signing key, TLS keys, RADIUS/WiFi/VPN credentials, NFC and facial-recognition templates), forge admin sessions, reconfigure firewalls and routing, unlock doors, disable or delete camera footage, and pivot to cloud-connected multi-site organizations. _Engineers assessing blast radius from an infrastructure compromise like this weigh these risks on daily.dev._ ## Similar posts on daily.dev - [Critical UniFi OS bug lets hackers gain root without authentication](https://daily.dev/posts/critical-unifi-os-bug-lets-hackers-gain-root-without-authentication-wfqtinglo) · BleepingComputer · 0 upvotes · 0 comments - [CISA warns of max severity Ubiquiti flaws exploited in attacks](https://daily.dev/posts/cisa-warns-of-max-severity-ubiquiti-flaws-exploited-in-attacks-28ufbhywd) · BleepingComputer · 0 upvotes · 0 comments - [Ubiquiti patches three max severity security vulnerabilities](https://daily.dev/posts/ubiquiti-patches-three-max-severity-security-vulnerabilities-sqjb5anhz) · BleepingComputer · 0 upvotes · 0 comments - [Ubiquiti warns of new max severity UniFi OS vulnerability](https://daily.dev/posts/ubiquiti-warns-of-new-max-severity-unifi-os-vulnerability-jcgjhlz0x) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/popping-root-on-unifi-os-server-unauthenticated-rce--q8bfe1sor) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Popping Root on UniFi OS Server: Unauthenticated RCE…","url":"https://daily.dev/posts/popping-root-on-unifi-os-server-unauthenticated-rce--q8bfe1sor","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/popping-root-on-unifi-os-server-unauthenticated-rce--q8bfe1sor"},"datePublished":"2026-08-23T12:19:03.667Z","dateModified":"2026-08-23T12:31:10.467Z","description":"Bishop Fox details a chained, unauthenticated remote code execution vulnerability in Ubiquiti's UniFi OS Server, combining an Nginx authentication gateway...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e01795d9fb709c61ebba36a73df3df0f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e01795d9fb709c61ebba36a73df3df0f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/popping-root-on-unifi-os-server-unauthenticated-rce--q8bfe1sor","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vulnerability","timeRequired":"PT22M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"Popping Root on UniFi OS Server: Unauthenticated RCE…"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/popping-root-on-unifi-os-server-unauthenticated-rce--q8bfe1sor#faq","mainEntity":[{"@type":"Question","name":"What CVEs are involved in the UniFi OS Server unauthenticated root RCE chain and what version fixes them?","acceptedAnswer":{"@type":"Answer","text":"The chain combines CVE-2026-34908 and CVE-2026-34909 (authentication gateway bypass, both CVSS 10.0) with CVE-2026-34910 (command injection in the package-update service, also CVSS 10.0). Chained together they yield unauthenticated remote code execution escalating to root. The fix ships in UniFi OS Server 5.0.8 (unifi-core 5.0.153); builds at or below 5.0.6 are affected, and hardware appliances have separate per-model fixed versions. Track critical CVEs like this UniFi OS chain on daily.dev before they hit your patch queue."}},{"@type":"Question","name":"Why doesn't patching UniFi OS Server to 5.0.8 fully remediate a prior compromise?","acceptedAnswer":{"@type":"Answer","text":"Patching closes the exploitation path but does not invalidate a session-token signing key an attacker already stole, since token verification logic is unchanged in 5.0.8. Forged admin tokens minted from that key continue working against patched consoles, surviving reboots, password resets, and the upgrade itself, until the JWT signing key is explicitly rotated and, for confirmed compromises, the console is rebuilt. Anyone triaging a vendor patch weighs remediation steps like key rotation on daily.dev before declaring an incident closed."}},{"@type":"Question","name":"What can an attacker do with root access on a UniFi OS Server appliance managing UniFi Access and Protect?","acceptedAnswer":{"@type":"Answer","text":"Root access grants full administrative control over the network, physical doors, and cameras it manages: an attacker can read every stored secret (JWT signing key, TLS keys, RADIUS/WiFi/VPN credentials, NFC and facial-recognition templates), forge admin sessions, reconfigure firewalls and routing, unlock doors, disable or delete camera footage, and pivot to cloud-connected multi-site organizations. Engineers assessing blast radius from an infrastructure compromise like this weigh these risks on daily.dev."}}]} ```