CVE-2020-5849

What is Unraid?

Unraid is a Linux-based operating system for home-server and small-business NAS builds, popular in the self-hosting and homelab community for combining flexible storage arrays with the ability to run virtual machines and Docker containers on the same box. Its web-based management interface (the Unraid "webGUI") controls storage arrays, shares, and every VM/container running on the host — full administrative access to the interface means full control of the server.

Overview

CVE-2020-5849 is an authentication bypass vulnerability (CWE-697, incorrect comparison) that allows an unauthenticated remote attacker to gain access to Unraid's administrative web interface (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High). CISA's own description notes it is chainable with the related CVE-2020-5847 to escalate from authentication bypass to full remote code execution.

Technical Details

The vulnerability stems from an incorrect comparison logic error in how the webGUI validates authentication state, allowing certain crafted requests to be treated as authenticated when they should not be. Reaching the admin interface this way opens the door to further exploitation — including the related CVE-2020-5847 — since Unraid's webGUI exposes functionality (plugin installation, Docker/VM management, direct file access) that a fully authenticated administrator would use, any of which can be leveraged toward code execution once bypassed into.

Discovery

Publicly tracked via NVD; disclosed alongside the related, chainable CVE-2020-5847.

Exploitation Context

CISA added this CVE to KEV in November 2021 based on confirmed exploitation. Because Unraid is popular in the homelab/self-hosting community — a population that may prioritize convenience over hardening — instances left exposed to the internet without additional access controls represent a meaningful population of potentially vulnerable targets.

Remediation

1. Update Unraid to the version that fixes both this CVE and the related CVE-2020-5847.
2. Never expose the Unraid webGUI directly to the internet — use a VPN for remote access rather than port-forwarding the management interface.
3. Enable Unraid's built-in webGUI authentication and use a strong, unique password, layering defense-in-depth on top of the underlying fix.
4. Audit for unauthorized plugins, Docker containers, or VMs on any Unraid server that may have had its webGUI exposed and unpatched, since chained exploitation via CVE-2020-5847 could result in full remote code execution.