Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release trains before their respective fixes) allows an attacker on the same network segment to achieve unauthenticated full-administrator API access and execute commands as root. middlewared registers the HA peer-authentication hook (ha_permission) unconditionally, with no failover-licence or heartbeat-interface check. An unauthenticated connection whose TCP peer address is a hardcoded HA heartbeat address (169.254.10.1 or 169.254.10.2) and whose peer port is <= 1024 is granted a node credential that is authorized for every API method and treated as full administrator. Both conditions are properties of the attacker's own socket, and thus an attacker on the same layer-2 segment satisfies them without forging anything. The hook is present on non-HA, unlicensed, single-node Community Edition installations. The fix additionally requires that the connection terminate on the HA hear
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-123033 represents a critical authentication bypass in TrueNAS SCALE's middlewared component that allows unauthenticated attackers on the same network segment to gain full administrator API access and execute arbitrary commands as root. The vulnerability stems from an unconditional registration of the HA peer-authentication hook (ha_permission) without proper failover-license or heartbeat-interface validation, enabling attackers to spoof legitimate High Availability heartbeat connections. This affects organizations relying on TrueNAS SCALE for NAS storage and data management, particularly those with network-accessible systems in shared infrastructure environments. The severity is amplified by the complete absence of authentication requirements—an attacker needs only network proximity to compromise the entire system with root-level privileges.
While Casky.ai currently shows zero direct skill matches for this specific CVE, practitioners using the platform would benefit from broader detection strategies aligned with lateral movement and credential abuse patterns. An organization's detection posture would focus on identifying anomalous API calls from unexpected network peers, reconnaissance of the HA interface configuration, and post-exploitation indicators such as unexpected root process execution or privileged command invocation through the middlewared API. The attack chain—spoofed heartbeat origin, bypassed authentication validation, and root command execution—mirrors patterns that Claude AI's extended reasoning capabilities can map to techniques like T1021 (Remote Service Session Initiation), T1078 (Valid Accounts), and T1548 (Abuse Elevation Control Mechanism). Security teams should monitor network logs for suspicious connections to heartbeat ports and implement network segmentation to restrict HA traffic to verified peer addresses.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-123033. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation