CVE-2026-36851 Overview
CVE-2026-36851 is a path traversal vulnerability [CWE-22] in UnPoller version 2.33.0. The flaw resides in the password field handling within the application. An attacker who can supply input to this field can escape the intended directory boundary and read arbitrary files on the host. The vulnerability also enables network exfiltration of the retrieved file contents. UnPoller is an open source metrics collector that polls UniFi controllers and forwards data to time-series backends.
Critical Impact
Attackers can read arbitrary files from the host filesystem through the password field and exfiltrate contents over the network, exposing credentials, configuration data, and secrets.
Affected Products
- UnPoller 2.33.0
Discovery Timeline
- 2026-08-26 - CVE-2026-36851 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-36851
Vulnerability Analysis
UnPoller 2.33.0 fails to sanitize input supplied to the password field. Instead of treating the value as an opaque credential, the application dereferences it as a filesystem path during processing. An attacker who controls this input can supply relative path sequences such as ../../etc/passwd to traverse outside the intended directory. The application then reads the target file and forwards the contents through its normal network channels, producing an arbitrary file read primitive with built-in exfiltration.
Root Cause
The root cause is missing input validation and improper path canonicalization on the password field. UnPoller does not enforce that the value remain a credential string or restrict filesystem access to an allow-listed directory. The result is a classic path traversal condition in a field that should never touch the filesystem.
Attack Vector
Exploitation requires the ability to submit a crafted password value to the vulnerable UnPoller instance. The attacker replaces the expected credential with a path traversal payload that references a sensitive file readable by the UnPoller process. The application resolves the path, reads the file, and transmits the contents to the configured backend or attacker-controlled endpoint. Refer to the GitHub PoC for CVE-2026-36851 and the UnPoller project repository for technical details.
Detection Methods for CVE-2026-36851
Indicators of Compromise
- Password field values in UnPoller configuration or runtime input containing ../ or ..\ sequences.
- Unexpected file reads by the UnPoller process against sensitive paths such as /etc/passwd, /etc/shadow, or configuration directories.
- Outbound network traffic from UnPoller containing contents of local files rather than metric data.
Detection Strategies
- Inspect UnPoller configuration files and process arguments for path-like values in credential fields.
- Monitor filesystem access by the UnPoller process and alert on reads outside its expected working directories.
- Baseline UnPoller network traffic volume and payload shape, then alert on anomalies suggesting file exfiltration.
Monitoring Recommendations
- Enable audit logging on hosts running UnPoller to capture file open events for sensitive paths.
- Forward host telemetry and application logs to a centralized data lake for correlation across polling intervals.
- Track egress connections from UnPoller instances and validate that destinations match approved metrics backends.
How to Mitigate CVE-2026-36851
Immediate Actions Required
- Inventory all UnPoller deployments and identify instances running version 2.33.0.
- Restrict access to the UnPoller configuration interface and any endpoints that accept credential input.
- Rotate credentials and secrets stored on hosts running vulnerable UnPoller instances, as prior exposure cannot be ruled out.
Patch Information
No fixed version is referenced in the available advisory data. Monitor the UnPoller project repository for updates addressing CVE-2026-36851 and apply patches once released.
Workarounds
- Run UnPoller as an unprivileged user with a restricted filesystem view using chroot, containers, or mount namespaces.
- Apply mandatory access control policies such as AppArmor or SELinux to limit which files the UnPoller process can read.
- Place UnPoller behind network segmentation that blocks outbound connections to any destination other than approved metrics backends.
# Example AppArmor-style restriction for the UnPoller process
# Deny reads outside the expected configuration and runtime paths
deny /etc/shadow r,
deny /etc/passwd r,
deny /root/** r,
allow /etc/unpoller/** r,
allow /var/lib/unpoller/** rw,
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
