HA Heartbeat-Origin Authentication Bypass (CVE Pending)

Status: Advisory Affected products: TrueNAS CE/Enterprise (SCALE) — middlewared. TrueNAS CORE: Not Affected. Severity (TrueNAS-adjusted): High — CVSS 3.1 8.3 (AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) CWE: CWE-290 (Authentication Bypass by Spoofing), CWE-306 (Missing Authentication for Critical Function) Fixed in: TrueNAS SCALE 25.10.8 (forthcoming) and later (25.10 train) Credit: Reported by spnctf through coordinated disclosure.

The TrueNAS middleware (middlewared) includes a peer-authentication hook used between the two controllers of a High Availability (HA) appliance over the private heartbeat link. On affected versions this hook made its trust decision from the TCP peer address and source port of the incoming connection alone: a connection whose peer address was one of the hardcoded HA heartbeat addresses (169.254.10.1 / 169.254.10.2) and whose source port was 1024 or lower was granted an internal node credential that is treated as a full administrator for every API method.

Because that decision relied only on attacker-influenceable properties of the connection, and because the hook was registered on all installations — including non-HA, single-node Community Edition systems with no HA configuration — an attacker able to meet those conditions could obtain unauthenticated administrative API access without presenting any credential. Administrative access to the API can in turn be used to execute commands on the underlying operating system as root.

The hook was present regardless of whether the system is licensed for HA, has HA hardware, or has any HA configuration, so single-node Community Edition and Enterprise systems were in scope, not only HA pairs. TrueNAS CORE does not share this middleware code and is not affected.

Exploitation is not possible from an arbitrary Internet location. The trust check keys on a 169.254.10.x link-local source address, and a stock TrueNAS system disables IPv4 link-local autoconfiguration and holds no route to the 169.254.0.0/16 range. As a result:

• The attacker must be on the same layer-2 network segment as the appliance’s management interface (for example a virtual machine on the same hypervisor switch, a host on the same flat VLAN, or the network gateway).
• Adjacency by itself is not sufficient. Because the system has no route back to a 169.254.10.x address, the attacker must additionally alter the return path — either by modifying routing on the TrueNAS system or by controlling the gateway/path — to complete the exchange. This raises attack complexity materially.

Where those conditions are met, the impact is high: unauthenticated administrative control of the API, which bypasses the management-interface IP allowlist and API rate limiting, can read configuration secrets, is not recorded in the audit log, and can lead to command execution as root. On a typical deployment — a TrueNAS appliance whose management interface is on a trusted, switched management network the operator controls — the practical exposure is limited by the adjacency and return-path requirements above.

Primary (apply now): Keep the TrueNAS management interface on a dedicated, trusted management network. Ensure no untrusted host shares the management interface’s layer-2 segment (isolate hypervisor virtual switches and management VLANs), so that no untrusted party can originate traffic from a 169.254.10.x source address toward the management interface. This fully blocks the exposure and is the recommended action today.

Update when a fixed release is available for your train: The corrected code — which requires that the connection also terminate on the HA heartbeat listener, a local address and port the attacker cannot control, before the node credential is granted — is included in TrueNAS SCALE 25.10.8, a forthcoming release on the 25.10 train (Community Edition and Enterprise), and later. Until that release is published, rely on the network mitigation above.

TrueNAS has corrected the HA node-authentication check so that trust additionally depends on the connection terminating on the heartbeat listener, which is bound only on the heartbeat interface. The fix is included in TrueNAS SCALE 25.10.8 — a forthcoming release — and later on the 25.10 train. Until that release is available, apply the network mitigation above. This advisory will be updated with the assigned CVE identifier and as fixed releases become available.