CVE-2026-40302 — zrok
MEDIUMCVE-2026-40302 is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in github.com/openziti/zrok. A fix is available for github.com/openziti/zrok — see the affected versions and patch details below.
zrok has reflected XSS in GitHub OAuth callback via unsanitized refreshInterval error rendering
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-40302.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
github.com/openziti/zrok🐹github.com/openziti/zrok/v2Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary The proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin.
- Attack Vector: Network — the attack is delivered as a crafted URL over the internet.
- Attack Complexity: Low — no race conditions or special environment prerequisites.
- Privileges Required: None — the attacker needs no account on the zrok instance.
- User Interaction: Required — the victim must click the crafted link and complete the GitHub OAuth flow.
- Scope: Changed — the injected script executes in the OAuth server's origin, not the victim's share origin.
- Confidentiality Impact: Low — the script runs in the OAuth server origin after a failed flow; no session cookie is set at this point, limiting what can be exfiltrated to what is visible in the DOM and what can be requested from the OAuth server.
- Integrity Impact: Low — the script can initiate new OAuth flows or submit forms on behalf of the victim in the OAuth server origin.
- Availability Impact: None.
Affected Components
- endpoints/proxyUi/template.go — init() / WriteTemplate (lines 8, 18, 99) — text/template used for HTML rendering
- endpoints/proxyUi/template.html — line 119 — {{ .Error }} in HTML without escaping
- endpoints/publicProxy/providerGithub.go — login callback closure (lines 93, 128, 130)
- endpoints/dynamicProxy/providerGithub.go — loginHandler() (lines 110, 146, 148)
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/openziti/zrok | all versions | No fix |
| 🐹Go | github.com/openziti/zrok/v2 | all versions | 2.0.1go get github.com/openziti/zrok/v2@v2.0.1 |
Affected Products
zroknetfoundryDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/openziti/zrok, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
A fix is available for CVE-2026-40302; check the affected-versions list above or the advisory for the patched release of github.com/openziti/zrok, then make sure no transitive dependency still pins the vulnerable range.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is CVE-2026-40302 in your dependencies?
Find it across Go, including transitive dependencies.