CVE-2026-45568: critical vulnerability in openziti zrok
zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.9epss 0.5%
zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing requests.request to return a server-side response from an attacker-chosen URL. This issue is fixed in version 2.0.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:L
Affected products
openziti · zrokRelated CVEs — openziti zrok
In the same product, most dangerous first.
CVE-2026-45576HIGHzrok copy writes attacker-controlled WebDAV paths outside the destination rootEPSS 0.5%CVE-2026-40303HIGHzrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsingEPSS 0.5%CVE-2026-42275HIGHzrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeEPSS 0.3%CVE-2026-40304MEDIUMzrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend recordsEPSS 0.3%CVE-2026-40302MEDIUMzrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error renderingEPSS 0.2%