CVE-2026-55115: A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device

Synopsis

A Server-Side Request Forgery (SSRF) vulnerability affects the UniFi Protect Application by Ubiquiti Inc. The flaw is reachable over the network and requires only a low-privilege account; no additional user interaction is necessary. Successful exploitation allows an attacker to escalate privileges on the host device, with full confidentiality, integrity, and availability impact on resources beyond the application itself. A patched-image rebuild at version 7.1.83 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UniFi Protect Application service over the network; no local access or physical presence is required.

• AuthenticationRequired

  A low-privilege account on the application is sufficient; no administrative or elevated credentials are needed to begin the attack.

• Victim interactionNot required

  No action from another user or victim is necessary; the attacker can trigger the SSRF entirely on their own.

• Attack complexityDetail

  Exploit conditions are straightforward and require no race conditions, special memory layout, or environmental prerequisites, making the attack reliably repeatable.

Blast Radius

• Reads sensitive data from internal services reachable by the host, including configuration files, credentials, and session material.
• Modifies data or issues commands to internal network services by forging requests that originate from the trusted host.
• Escalates privileges on the underlying host device, potentially gaining root or system-level control.
• Crashes or disrupts the host device or dependent services through unrestricted access to internal endpoints.