ACTIVELY EXPLOITED
CVE-2020-5849: Unraid Authentication Bypass Vulnerability
| Vendor | Unraid |
|---|---|
| Product | Unraid |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 3 May 2022 |
| Weakness (CWE) | CWE-287, CWE-697 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
Unraid contains an authentication bypass vulnerability that allows attackers to gain access to the administrative interface. This CVE is chainable with CVE-2020-5847 for remote code execution.
SOURCES
Other Unraid flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.