SSRF in zrok Python SDK ProxyShare (CVE-2026-45568)

A Server-Side Request Forgery (SSRF) vulnerability exists in the zrok Python SDK's ProxyShare component. When a path containing an absolute URL is submitted to the Flask proxy handler, `urllib.parse.urljoin` resolves the attacker-supplied absolute URL instead of the configured target, causing the proxy to forward requests to an arbitrary host chosen by the attacker and return the response. This allows unauthenticated remote attackers to use the proxy to reach internal or external systems with high impact to confidentiality and integrity. Affected versions: - v0.4.47 - v2.0.2 We recommend updating to: 2.0.3. CVSS 9.9 · our assessment: act_now Vendor advisory: https://github.com/openziti/zrok/security/advisories/GHSA-jh67-hwqw-m5r7 Details: https://vuln.today/cve/CVE-2026-45568