InvestigatarrInvestigatarr| critical | Root password is reused in a container Found in nextcloud:DB_PASSWORD, mariadb:MYSQL_PASSWORD. Anyone who can read that container's settings or appdata has your root password. Fix: Change the root password, and keep it unique. | |
| high | User 'carol' has no share password Anyone on the network can open this user's shares as them. Fix: Set a password for carol under Users. | |
| high | SSH on port 22 with UPnP enabled SSH may be exposed to the internet by a UPnP rule. Fix: Disable UPnP or move SSH off the default port. | |
| high | SMB share 'appdata' is public Anyone on the network can read and write this share without a password. Fix: Shares > appdata > SMB Security: Private or Secure. | |
| high | Container 'plex' runs privileged A privileged container can take over the whole host. Fix: Edit the container and turn Privileged off unless it truly needs it. | |
| high | Container 'plex' has the Docker socket Docker socket access is equivalent to root on the host, even read-only. Fix: Remove the mount, or put a socket proxy in front of it. | |
| medium | Web UI is served over plain HTTP Logins to the web UI can be sniffed on the network. Fix: Settings > Management Access > Use SSL/TLS: Strict or Yes. | |
| medium | UPnP is enabled Containers and services can open ports on your router without asking. Fix: Settings > Management Access > Use UPnP: No, and forward ports by hand. | |
| medium | SSH accepts password logins Password logins over SSH can be brute forced. Fix: Add a key under Users > root > SSH authorized keys and set PasswordAuthentication no. | |
| medium | Container 'nextcloud' adds NET_ADMIN These capabilities grant near-root control of the host. Fix: Remove the --cap-add flags from Extra Parameters if not needed. | |
| medium | Same password used by 2 containers Used in nextcloud:DB_PASSWORD, mariadb:MYSQL_PASSWORD. One leaked app config exposes the others. Fix: Give each container its own random password. | |
| medium | Users alice, bob share a password Their share passwords are identical. Fix: Give each user their own password under Users. | |
| medium | qBittorrent can open router ports with UPnP Its settings (/mnt/user/appdata/qbittorrent/qBittorrent/qBittorrent.conf) let it forward ports on your router without asking. Fix: Tools > Options > Connection > untick 'Use UPnP / NAT-PMP', and forward the port by hand. If you use a VPN container, forward it there instead. | |
| medium | VM 'win10' has VNC with no password Anyone on the LAN can open the VM console. Fix: Set a VNC password in the VM's settings. | |
| low | Unraid 6.12.10 is an older release line Unraid 7.x is the current release line. Fix: Plan an upgrade to the latest 7.x release. | |
| low | Container 'plex' uses host networking It shares the host's network stack and can bind any port. Fix: Use bridge or a custom network unless host mode is required. |
| container | Container 'qbittorrent' stopped 115 days ago Remove it if you no longer use it. Its appdata is kept, and you can reinstall it from Apps > Previous Apps. docker:qbittorrent | |
| share | Share 'backups' is empty Remove it if you don't need it. Its settings stay under Shares. /mnt/user/backups | |
| empty | 1 empty file in share 'media' For example: /mnt/user/media/films/empty.nfo /mnt/user/media |