Critical severity9.1GHSA Advisory· Published Jul 16, 2026· Updated Jul 20, 2026
CVE-2026-45568
CVE-2026-45568
Description
zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing requests.request to return a server-side response from an attacker-chosen URL. This issue is fixed in version 2.0.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
zrokPyPI | >= 0.4.47, <= 1.1.11 | — |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/openziti/zrok/commit/7c1dc3ecd1c89d8cd2e845a72c3878bd2d31b4fenvdPatch
- github.com/advisories/GHSA-jh67-hwqw-m5r7ghsaADVISORY
- github.com/openziti/zrok/security/advisories/GHSA-jh67-hwqw-m5r7nvdVendor AdvisoryWEB
- github.com/openziti/zrok/releases/tag/v2.0.3nvdRelease Notes
News mentions
0No linked articles in our index yet.