Product by Go
Github.com/openziti/zrok
5 known vulnerabilities in Github.com/openziti/zrok (Go), 0 of them actively exploited (CISA KEV).
Key figures
5
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-45576 | zrok copy writes attacker-controlled WebDAV paths outside the destination root | 7.5 | |
| High | CVE-2026-40303 | zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing | 7.5 | |
| High | CVE-2026-42275 | zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write | 8.7 | |
| Medium | CVE-2026-40302 | zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering | 6.1 | |
| Medium | CVE-2026-40304 | Openziti Zrok: Incorrect Authorization | 5.3 |