CVE-2026-28798 in ZimaOS

Sumário (Inglês)

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Responsável

GitHub_M

Reservar

03/03/2026

Divulgação

03/04/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
355202	IceWhaleTech ZimaOS proxy Elevação de Privilégios	918	Não definido	Correção oficial	CVE-2026-28798

Fontes

• MITRE
• NVD
• CVE Details