github.com/openziti/zrok vulnerabilities (Go)

5 vulnerabilities.

• github.com/openziti/zrok Go zrok copy writes attacker-controlled WebDAV paths outside the destination root CVE-2026-45576 Fix available 8.3 HighMay 19, 2026
• github.com/openziti/zrok Go zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write CVE-2026-42275 Fix available 8.7 HighApril 25, 2026
• github.com/openziti/zrok Go zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records CVE-2026-40304 Fix available 5.3 MediumApril 16, 2026
• github.com/openziti/zrok Go zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing CVE-2026-40303 Fix available 7.5 HighApril 16, 2026
• github.com/openziti/zrok Go zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering CVE-2026-40302 Fix available 6.1 MediumApril 16, 2026