CVE-2026-28798 in ZimaOS

Resumen (Inglés)

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Responsable

GitHub_M

Reservar

2026-03-03

Divulgación

2026-04-03

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
355202	IceWhaleTech ZimaOS proxy escalada de privilegios	918	No está definido	Arreglo oficial	CVE-2026-28798

Fuentes

• MITRE
• NVD
• CVE Details