github.com/openziti/zrok/v2 (Go) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Go package github.com/openziti/zrok/v2, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2026-42275 — CVSS 8.7 (high): zrok is software for sharing web services, files, and network resources. Prior to version 2.0.2, the zrok WebDAV drive backend…
• CVE-2026-40303 — CVSS 7.5 (high): zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, endpoints.GetSessionCookie parses an…
• CVE-2026-40302 — CVSS 6.1 (medium): zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the proxyUi template engine uses Go's…
• CVE-2026-40304 — CVSS 5.3 (medium): zrok is software for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler…