by Kastro
Paper/Archive/CVE-2026-28798

CVE-2026-28798

IceWhaleTech ZimaOS — Arbitrary internal service access via /v1/sys/proxy when Cloudflare Tunnel is enabled on ZimaOS

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
37
CVSS 10.0 (NVD)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 33.6.336 × 206.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.

Affected

ProductAffectedFixed inSource
ZimaOS< 1.5.3–CNA

Scores by source

NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GitHub_M (CNA)9.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/IceWhaleTech/ZimaOS/security/advisories/GHSA-vqqj-f979-8c8mrefgithub.com/IceWhaleTech/ZimaOS/releases/tag/1.5.3