Read the docs
TI-2026-84855 Aliases CVE-2026-121734GHSA-wx9v-p2rq-5m8q

Authorization bypass in ZaneOps leaks other workspaces' environments

Priority MEDIUM 60CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

ZaneOps from 1.14.0 before 1.15.2 contains an authorization bypass (CWE-639) in ReviewPreviewEnvDeployAPIView. Any workspace administrator can read another workspace's pending preview environment because the query lacks project scoping. The exposed data includes plaintext environment variables and preview basic-auth credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00276 20th percentileScored 2026-11-07
Fix Fixed zane-ops (zane-ops): 1.15.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zane-opszane-ops1.14.0 to before 1.15.21.15.2Patch availableCNA
  • zane-ops Vendorzane-ops Affected 1.14.0 to before 1.15.2 Fixed in 1.15.2 Patch available CNA

Remediation

Upgrade ZaneOps to version 1.15.2, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

  • Fix · CNA zane-ops (zane-ops) Fixed in 1.15.2

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121734
  2. 2026-11-04 Alias added: GHSA-wx9v-p2rq-5m8q
  3. 2026-11-05 Priority changed: MEDIUM → LOW
  4. 2026-11-07 CISA SSVC decision points changed
  5. 2026-11-07 Priority changed: LOW → MEDIUM

References

Patch 1

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences