CVE-2026-28798 is a critical server-side request forgery (SSRF) vulnerability affecting ZimaOS versions prior to 1.5.3, specifically when exposed via a Cloudflare Tunnel. This flaw allows unauthenticated attackers to abuse a proxy endpoint to access internal localhost services, leading to high impact on confidentiality, integrity, and availability. Rated 9.0 CRITICAL with high attack complexity, this vulnerability has no known public exploits and is not currently being actively exploited. Community discussion is minimal, and it is not listed on the KEV catalog or Hot List.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.5.3CPE matchmatch criteria | cpe:2.3:o:zimaspace:zimaos:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.