Openziti vulnerabilities

Products

• Zrok 6
• Openziti 2
• Ziti-console 2

Newest

• openziti ziti OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation CVE-2026-58165 8.7 HighJune 30, 2026
• netfoundry zrok zrok copy writes attacker-controlled WebDAV paths outside the destination root CVE-2026-45576 Fix available 8.3 HighMay 19, 2026
• netfoundry zrok zrok Python ProxyShare can be used as an SSRF proxy through absolute URL paths CVE-2026-45568 9.9 CriticalMay 19, 2026
• netfoundry zrok zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write CVE-2026-42275 Fix available 8.7 HighApril 25, 2026
• netfoundry zrok zrok's broken ownership check in DELETE /api/v2/unaccess allows non-admin to delete global frontend records CVE-2026-40304 Fix available 5.3 MediumApril 16, 2026
• netfoundry zrok zrok allows unauthenticated DoS via unbounded memory allocation in striped session cookie parsing CVE-2026-40303 Fix available 7.5 HighApril 16, 2026
• netfoundry zrok zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering CVE-2026-40302 Fix available 6.1 MediumApril 16, 2026
• openziti, openziti ziti-console +1 more Server Side Request Forgery in Ziti Console CVE-2025-27501 8.6 HighMarch 3, 2025
• openziti, openziti ziti-console +1 more Cross Site Scripting potential in Ziti Console CVE-2025-27500 8.2 HighMarch 3, 2025