Unraid OS 7.3.5

Key points

Unraid OS 7.3.5 was published on 10 November 2026 as a maintenance release following 7.3.4. It brings CVE fixes in base packages, tighter security in the Unraid API, a newer Linux kernel and one new timezone, and the project recommends upgrading for the security fixes.

What changed

• The Linux kernel moves to 6.18.60-Unraid.
• The WebGUI gains support for the British Columbia timezone.
• 16 base packages are updated; the full list is in the release notes.

Unraid API security

• Protected GraphQL operations now enforce authorization.
• GraphQL requests are limited in request size and query complexity.
• Schema introspection requests are blocked when Developer Sandbox is disabled.
• Stored OIDC client secrets are no longer returned in API settings or provider responses.
• An update that omits the OIDC secret keeps the one already configured.
• Repeated OIDC authorization requests and callbacks are now bounded.

Who is affected

• API clients that use schema introspection with Developer Sandbox disabled may need to be adjusted.
• API clients that exceed the new size or complexity limits may also need to be adjusted.

Versions

• bind 9.20.29 → 9.20.30 (CVE-2026-19630, CVE-2026-94300, CVE-2026-96888, CVE-2026-97313).
• brotli 1.2.0-2 → 1.2.1 (CVE-2026-111497).
• patch 2.8-2 → 2.8.1 (CVE-2026-115207).
• util-linux 2.42.4 → 2.42.4-4 (CVE-2026-78408).
• btrfs-progs 7.1-2 → 7.3.
• zfs 2.4.4, rebuilt for kernel 6.18.60.
• dynamix.unraid.net (Unraid API) 4.37.5-2 → 4.37.11-2.

Known issues and rollback

• No new known issues specific to this release are listed; the 7.3.4 release notes cover the previous release's known issues.
• No rollback limitations specific to this release are listed.
• Upgrade steps are in the project's "Updating Unraid" guide, which the post links to.
• Bugs can be reported through the Bug Reports link in the post.

Summary by DistroNews, based on the original post.