CVE-2026-34909 is a path traversal flaw in Ubiquiti UniFi OS caused by the nginx reverse proxy extracting the destination service name from the raw, unnormalized request URI, so a network-adjacent attacker can craft a request that is authorized against one service but, after nginx normalizes the path, is routed to a different, restricted one — and it was exploited in the wild as part of a documented authentication-bypass chain.
Vulnerability summary
10
Critical
68.0%
EPSS score (FIRST)
Yes
CISA KEV catalog
2026-05-22
Published
Vulnerability ID: CVE-2026-34909 · Source: NVD (HackerOne-submitted Secondary score only, not NVD Primary)
Affected components
| Component | CPE | Version range |
|---|---|---|
| Ubiquiti UniFi OS (Cloud Gateways, Dream Machine family, UNVR, UNAS, UniFi Express, UniFi OS Server) | cpe:2.3:a:ui:unifi_os_server:*:*:*:*:*:*:*:* | Per NVD CPE data: UniFi OS Server before 5.0.8; most Dream Machine / Cloud Gateway / UNVR firmware before 5.1.12; UniFi Dream Machine Beast before 5.1.11; UNAS family before 5.1.10; UniFi Express before 4.0.14 (fixed in the versions named, per Ubiquiti Security Advisory Bulletin 064) |
What this means
CVE-2026-34909 is a path traversal vulnerability (CWE-22) in Ubiquiti UniFi OS. UniFi OS's authorization layer identifies the destination backend service by matching a regular expression against the raw request URI before nginx normalizes percent-encoded traversal sequences; an attacker can embed sequences such as ..%2f in the path so the authorization check approves one service while the normalized request is actually routed to a different, restricted service, letting a network-adjacent attacker reach files and APIs that should not be reachable (NVD).
NVD's vulnStatus for this record is Analyzed, but the only CVSS metric on file is a Secondary rating of 10.0 (critical) submitted via HackerOne, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. NVD has not published its own independent Primary CVSS score (NVD).
NVD's CPE match data lists UniFi OS Server before 5.0.8 as vulnerable, along with most Cloud Gateway, Dream Machine and Network Video Recorder firmware lines before 5.1.12, UniFi Dream Machine Beast before 5.1.11, the UNAS family before 5.1.10, and UniFi Express before 4.0.14 — matching the fixed versions Ubiquiti lists in Security Advisory Bulletin 064 (NVD; Ubiquiti Security Advisory Bulletin 064).
Singapore's Cyber Security Agency issued an alert on the same bulletin, confirming three UniFi OS CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) and urging administrators to update to the latest versions immediately (CSA Singapore Alert AL-2026-059). The researcher who reported the flaw through Ubiquiti's bug bounty program describes CVE-2026-34909 as the authorization-bypass step in a chain that, combined with CVE-2026-34908 and CVE-2026-34910, can expose the device's full network configuration, including private keys and VPN credentials, from an unauthenticated position (Catchify Security: Pre-Auth RCE in UniFi OS).
CISA added CVE-2026-34909 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-23, alongside CVE-2026-34908, with a required-action due date of 2026-06-26; known ransomware-campaign use is recorded as "Unknown" (CISA KEV).
As of 2026-10-30, FIRST scores the probability of exploitation at 0.6803 (99.323th percentile) (FIRST EPSS).
Because this flaw is part of a documented unauthenticated exploit chain affecting network gateways, NVRs and storage appliances, any UniFi OS device on a build older than the fixed versions above should be updated immediately rather than relying on network placement alone.
Evidence
- Path traversal in UniFi OS's nginx reverse proxy lets a network-adjacent attacker bypass per-service authorization by exploiting a URI normalization mismatch, reaching restricted services. — NVD
- CVSS v3.1 base score is 10.0 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, submitted via HackerOne as a Secondary rating; NVD's vulnStatus is Analyzed but NVD has not published its own Primary score. — NVD
- Fixed versions per NVD CPE data and Ubiquiti's bulletin: UniFi OS Server 5.0.8+, most Cloud Gateway/Dream Machine/NVR firmware 5.1.12+, Dream Machine Beast 5.1.11+, UNAS family 5.1.10+, UniFi Express 4.0.14+. — Ubiquiti Security Advisory Bulletin 064
- CSA Singapore confirms three UniFi OS CVEs (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910) under the same bulletin and urges immediate update. — CSA Singapore Alert AL-2026-059
- The vulnerability is the authorization-bypass step of a chain with CVE-2026-34908 and CVE-2026-34910 that can expose private keys and VPN credentials from an unauthenticated position. — Catchify Security
- Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-23, due date 2026-06-26, known ransomware-campaign use recorded as "Unknown". — CISA KEV
- EPSS score is 0.6803 (99.323th percentile) as of 2026-10-30. — FIRST EPSS
