Vendor
Openziti
9 known vulnerabilities in products by Openziti, 0 of them actively exploited (CISA KEV).
Key figures
9
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-45568 | zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths | 9.1 | |
| High | CVE-2026-45576 | zrok copy writes attacker-controlled WebDAV paths outside the destination root | 7.5 | |
| High | CVE-2026-58165 | OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation | 8.8 | |
| High | CVE-2026-40303 | zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing | 7.5 | |
| High | CVE-2026-42275 | zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write | 8.7 | |
| High | CVE-2025-27501 | Server Side Request Forgery in Ziti Console | 8.6 | |
| High | CVE-2025-27500 | Cross Site Scripting potential in Ziti Console | 8.2 | |
| Medium | CVE-2026-40302 | zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering | 6.1 | |
| Medium | CVE-2026-40304 | Openziti Zrok: Incorrect Authorization | 5.3 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,
Products
| Zrok | 6 | 0 |