Skip to content
OpenAdvisories

Package · Go

github.com/openziti/zrok

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-40304

    zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records

    zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard: when a frontend record has environment_id = NULL (the marker for ad…

    openziti zrok github.com/openziti/zrok/v2 github.com/openziti/zrok Go
  • Medium 6.1
    CVE-2026-40302

    zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering

    zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicP…

    openziti zrok github.com/openziti/zrok/v2 github.com/openziti/zrok Go