CVE-2026-40304 openziti CVE debrief

Who should care

zrok users and administrators should assess exposure and update to version 2.0.1 to prevent unauthorized deletion of global frontends. This vulnerability affects public shares routed through global frontends created before the patch. Users should verify their zrok version and review access controls to ensure security.

Why it matters

CVE-2026-40304 is a medium-severity vulnerability in zrok software that allows a non-admin user to permanently delete global frontends, impacting public shares. The issue is patched in version 2.0.1.

• Potential unauthorized deletion of global frontends
• Impact on public shares routed through affected frontends
• Verification of zrok version and access controls required
• Update to version 2.0.1 or later recommended

Technical summary

The unaccess handler in zrok software prior to version 2.0.1 contains a logical error in its ownership guard. This error allows a non-admin user to permanently delete global frontends by exploiting the condition when a frontend record has environment_id = NULL. The issue is patched in version 2.0.1. Users should update to this version to prevent unauthorized deletion of global frontends. The vulnerability impacts public shares routed through affected frontends. A non-admin user who knows a global frontend token can call DELETE /api/v2/unaccess with any of their own environment IDs to delete the global frontend.

Defensive priority

Medium priority for zrok users to update to version 2.0.1 to prevent unauthorized deletion of global frontends.

Recommended defensive actions

• Update zrok to version 2.0.1 or later
• Review and restrict access to the unaccess handler
• Monitor for suspicious DELETE /api/v2/unaccess requests
• Verify zrok version and access controls
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• technicalSummary

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its patch. The issue is related to the unaccess handler in zrok software prior to version 2.0.1. Evidence is limited to public CVE and NVD records. Defensive verification tasks include reviewing zrok version and access controls, monitoring for suspicious DELETE /api/v2/unaccess requests, and updating to version 2.0.1 or later.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.