CVE-2026-40302

Summary
The proxyUi template engine uses Go's text/template (which performs no HTML escaping) instead of html/template. The GitHub OAuth callback handlers in both publicProxy and dynamicProxy embed the attacker-controlled refreshInterval query parameter verbatim into an error message when time.ParseDuration fails, and render that error unescaped into HTML. An attacker can deliver a crafted login URL to a victim; after the victim completes the GitHub OAuth flow, the callback page executes arbitrary JavaScript in the OAuth server's origin.

• Attack Vector: Network, the attack is delivered as a crafted URL over the internet.
• Attack Complexity: Low, no race conditions or special environment prerequisites.
• Privileges Required: None, the attacker needs no account on the zrok instance.
• User Interaction: Required, the victim must click the crafted link and complete the GitHub OAuth flow.
• Scope: Changed, the injected script executes in the OAuth server's origin, not the victim's share origin.
• Confidentiality Impact: Low, the script runs in the OAuth server origin after a failed flow; no session cookie is set at this point, limiting what can be exfiltrated to what is visible in the DOM and what can be requested from the OAuth server.
• Integrity Impact: Low, the script can initiate new OAuth flows or submit forms on behalf of the victim in the OAuth server origin.
• Availability Impact: None.

Affected Components

• endpoints/proxyUi/template.go, init() / WriteTemplate (lines 8, 18, 99), text/template used for HTML rendering
• endpoints/proxyUi/template.html, line 119, {{ .Error }} in HTML without escaping
• endpoints/publicProxy/providerGithub.go, login callback closure (lines 93, 128, 130)
• endpoints/dynamicProxy/providerGithub.go, loginHandler() (lines 110, 146, 148)

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

CVE-2026-40302 has a CVSS score of 6.1 (Medium). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.0.1); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2026-40302? CVE-2026-40302 is a medium-severity cross-site scripting (XSS) vulnerability in github.com/openziti/zrok (go), affecting versions <= 1.1.11. It is fixed in 2.0.1. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. How severe is CVE-2026-40302? CVE-2026-40302 has a CVSS score of 6.1 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2026-40302?
   • github.com/openziti/zrok (go) (versions <= 1.1.11)
   • github.com/openziti/zrok/v2 (go) (versions < 2.0.1)
4. Is there a fix for CVE-2026-40302? Yes. CVE-2026-40302 is fixed in 2.0.1. Upgrade to this version or later.
5. Is CVE-2026-40302 exploitable, and should I be worried? Whether CVE-2026-40302 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-40302 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-40302? Upgrade github.com/openziti/zrok/v2 to 2.0.1 or later.