Loading story…
A high-severity server-side request forgery flaw tracked as CVE-2026-45568 was disclosed in openziti zrok affecting versions 0.4.47 through before 2.0.3. The issue resides in the Python SDK's ProxyShare Flask proxy route, which accepted absolute URLs in the request path and passed them to URL-joining logic, allowing an attacker to override the intended target host and make the server fetch and return responses from attacker-chosen destinations. The vulnerability can be exploited over the network without privileges or user interaction and carries high confidentiality and integrity impact.
openziti addressed the flaw in zrok 2.0.3 by changing the proxy to reject absolute URL paths before forwarding requests. The fix adds target URL validation, returns HTTP 400 for invalid proxy paths, and includes tests covering direct and encoded absolute-URL rejection while preserving normal forwarding of relative paths. The associated patch notes say the change prevents viewers from coercing the proxy into requesting arbitrary internal or loopback services instead of the configured upstream target.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-45568 was published as a vulnerability affecting openziti zrok versions 0.4.47 through before 2.0.3, describing how the Python SDK ProxyShare route could be abused as an SSRF proxy via absolute URL paths. The advisory states the issue was fixed in zrok version 2.0.3 and that the GitHub advisory, release, and commit references were published on July 16, 2026.
A GitHub commit in the openziti zrok project changed the Python SDK ProxyShare logic to reject absolute URL paths, preventing proxying to attacker-chosen internal or loopback services. The patch added target URL validation, returned HTTP 400 for invalid proxy paths, and introduced tests for absolute-path rejection and normal relative-path forwarding.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in **OAuth2 Proxy** can let unauthenticated remote attackers reach protected upstream resources in specific reverse-proxy deployments. `CVE-2026-34457` affects versions prior to **7.15.2** when OAuth2 Proxy is used with **auth_request**-style integrations such as nginx `auth_request` and either `--ping-user-agent` or `--gcp-healthchecks` is enabled. In that configuration, any request carrying the configured health-check User-Agent can be treated as a successful health check regardless of the requested path, creating an authentication bypass. The flaw is tracked as **CWE-290** and carries a **CVSS 3.1** score vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`. A second flaw, `CVE-2026-40575`, affects OAuth2 Proxy versions **7.5.0 through 7.15.1** when `--reverse-proxy` is enabled alongside `--skip-auth-regex` or `--skip-auth-route`. In those setups, the product may trust a client-supplied `X-Forwarded-Uri` header, allowing attackers to spoof the header so authentication and skip-auth rules are evaluated against a different path than the one actually forwarded upstream. Both issues were fixed in **OAuth2 Proxy 7.15.2**. Recommended mitigations include upgrading immediately, stripping or overwriting `X-Forwarded-Uri`, restricting direct access to OAuth2 Proxy, and narrowing or removing skip-auth rules where possible.
Jun 29, 2026
A critical vulnerability in ProxySQL, tracked as **CVE-2026-48772**, allows remote attackers to spoof client source IP addresses by abusing improper parsing of HAProxy PROXY protocol v1 `UNKNOWN` headers. A crafted frame with appended address fields can cause ProxySQL to trust a forged IP and use it in `mysql_query_rules.client_addr`, `stats_mysql_processlist.cli_host`, and `event_log`, enabling access-control and routing bypass as well as misleading audit trails. The issue affects ProxySQL versions **2.0.0 through 3.0.8** and is especially dangerous because `mysql-proxy_protocol_networks = '*'` is the default, exposing any reachable MySQL frontend to attempted exploitation. The flaw was reproduced in testing by sending a forged address that triggered query rules intended for a different client, demonstrating the ability to influence schema pinning, query filtering, and other IP-based controls. ProxySQL addressed the issue in **version 3.0.9**, which also fixed another critical pre-authentication memory-corruption bug, **CVE-2026-48773**. Security advisories rate CVE-2026-48772 as remotely exploitable and severe, with published scores ranging from **CVSS 9.1 to 10.0**, and urge organizations running **3.0.8 or earlier** to upgrade immediately.
Jun 29, 2026
Two high-severity vulnerabilities were disclosed in **Roxy-WI**, the web interface used to manage **HAProxy, Nginx, Apache, and Keepalived**. The issues affect versions prior to **8.2.6.4** and were published as **`CVE-2026-33076`** and **`CVE-2026-33078`**. The first flaw is a **path traversal** issue in the `haproxy_section_save` interface that can let an attacker write arbitrary files, including into scheduled task locations, creating a path to **remote code execution**. The second flaw is a **SQL injection** vulnerability in the same `haproxy_section_save` functionality, where the `server_ip` parameter is passed unsanitized through multiple calls and inserted into a database query using Python string formatting. Both bugs are remotely exploitable with low attack complexity and can severely affect confidentiality, integrity, and availability. The vendor addressed both issues in **Roxy-WI 8.2.6.4**, with a patch commit and security advisory published alongside the disclosures.
Jun 29, 2026