TI-2026-33317 CVE-2026-45568 · GHSA-jh67-hwqw-m5r7
zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Priority MEDIUM 50
zrok is software for sharing web services, files, and network resources.
openziti
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high6CVSS 7.0–8.9
Exploited now
openziti records in CISA KEVNo openziti vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records
TI-2025-20335 CVE-2025-27500
Cross Site Scripting potential in Ziti Console
Priority MEDIUM 43
OpenZiti is a free and open source project focused on bringing zero trust to any application.
TI-2026-41883 CVE-2026-58165 · GHSA-c883-vc4m-3vc9
OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation
Priority MEDIUM 40
OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for…
TI-2026-30586 CVE-2026-42275 · GHSA-74m3-9qvm-rp9h
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
Priority MEDIUM 40
zrok is software for sharing web services, files, and network resources.
TI-2026-29081 CVE-2026-40303 · GHSA-cpf9-ph2j-ccr9
zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing
Priority LOW 39
zrok is software for sharing web services, files, and network resources.
TI-2026-33325 CVE-2026-45576 · GHSA-c656-jcx2-7pqj
zrok copy writes attacker-controlled WebDAV paths outside the destination root
Priority LOW 37
zrok is software for sharing web services, files, and network resources.
TI-2025-20336 CVE-2025-27501
Server Side Request Forgery in Ziti Console
Priority LOW 37
OpenZiti is a free and open source project focused on bringing zero trust to any application.
TI-2026-29080 CVE-2026-40302 · GHSA-4fxq-2x3x-6xqx
zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
Priority LOW 27
zrok is software for sharing web services, files, and network resources.
TI-2026-29082 CVE-2026-40304 · GHSA-3jpj-v3xr-5h6g
zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records
Priority LOW 24
zrok is software for sharing web services, files, and network resources.