Product by Openziti
Zrok
6 known vulnerabilities in Zrok (Openziti), 0 of them actively exploited (CISA KEV).
Key figures
6
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
1
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-45568 | zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths | 9.1 | |
| High | CVE-2026-45576 | zrok copy writes attacker-controlled WebDAV paths outside the destination root | 7.5 | |
| High | CVE-2026-40303 | zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing | 7.5 | |
| High | CVE-2026-42275 | zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write | 8.7 | |
| Medium | CVE-2026-40302 | zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering | 6.1 | |
| Medium | CVE-2026-40304 | Openziti Zrok: Incorrect Authorization | 5.3 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28sans-atrisk-mail,