What is the CVSS score of CVE-2026-28798?

CVE-2026-28798 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Zimaos are affected by CVE-2026-28798?

ZimaOS web interface versions before 1.5.3 contain a critical server-side request forgery vulnerability that allows unauthenticated remote attackers to bypass network segmentation and access internal…. A patch is available.

How to fix or mitigate CVE-2026-28798?

Within 24 hours: Identify all ZimaOS deployments running versions prior to 1.5.3, particularly those exposed via Cloudflare Tunnel or public-facing URLs; assess current exposure status. Within 7 days: Apply vendor-released patch to upgrade all affected ZimaOS instances to version 1.5.3 or later. Within 30 days: Conduct network segmentation review to ensure internal services are not reachable from web interface tiers, and implement access controls to restrict proxy endpoint (/v1/sys/proxy) usage.

Zimaos CVE-2026-28798

EUVD-2026-18843 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-03 security-advisories@github.com

SSRF Zimaos Zimaspace

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 22:23 vuln.today

cvss_changed

CVSS changed

Jul 24, 2026 - 22:23 NVD

9.0 (CRITICAL) 10.0 (CRITICAL)

Analysis Updated

Apr 16, 2026 - 05:46 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.5.3

EUVD ID Assigned

Apr 03, 2026 - 20:22 euvd

EUVD-2026-18843

Analysis Generated

Apr 03, 2026 - 20:22 vuln.today

CVE Published

Apr 03, 2026 - 20:16 nvd

CRITICAL 9.0

DescriptionNVD

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. Prior to version 1.5.3, a proxy endpoint (/v1/sys/proxy) exposed by ZimaOS's web interface can be abused (via an externally reachable domain using a Cloudflare Tunnel) to make requests to internal localhost services. This results in unauthenticated access to internal-only endpoints and sensitive local services when the product is reachable from the Internet through a Cloudflare Tunnel. This issue has been patched in version 1.5.3.

AnalysisAI

Server-side request forgery (SSRF) in ZimaOS web interface allows unauthenticated remote attackers to access internal localhost services when the system is exposed via Cloudflare Tunnel. The vulnerable proxy endpoint (/v1/sys/proxy) enables attackers to bypass network segmentation and reach internal-only endpoints, potentially exposing sensitive local services. Affects ZimaOS versions prior to 1.5.3. EPSS data not available; no public exploit identified at time of analysis, though the attack vector is well-understood given the clear SSRF nature and specific endpoint disclosure.

Technical ContextAI

This vulnerability involves a classic server-side request forgery (CWE-918) in ZimaOS, a fork of CasaOS designed for Zima hardware devices and x86-64 UEFI systems. The /v1/sys/proxy endpoint in the web interface acts as an HTTP proxy without proper access controls or request validation. When ZimaOS is configured with a Cloudflare Tunnel to enable external access, attackers can leverage this proxy to craft requests that originate from the ZimaOS server itself, bypassing localhost-only restrictions. The CVSS vector indicates network-based attack (AV:N) with high complexity (AC:H) due to the prerequisite Cloudflare Tunnel configuration, but requires no authentication (PR:N) and has scope change (S:C), meaning the vulnerability allows access beyond the vulnerable component's security scope to reach other internal services. This is particularly dangerous in home lab and small business environments where ZimaOS users commonly employ Cloudflare Tunnels for remote access without implementing additional authentication layers.

RemediationAI

Upgrade to ZimaOS version 1.5.3 or later, which patches the SSRF vulnerability in the proxy endpoint. The patched version is available at https://github.com/IceWhaleTech/ZimaOS/releases/tag/1.5.3. For systems that cannot be immediately upgraded, implement temporary mitigations by disabling external access via Cloudflare Tunnel until patching is complete, or implement network-level access controls (firewall rules, VPN requirements) to restrict access to the web interface to trusted IP ranges only. If Cloudflare Tunnel must remain active, configure Cloudflare Access or another authentication layer in front of the ZimaOS web interface to require user authentication before any requests reach the vulnerable proxy endpoint. After upgrading, review system logs for any suspicious proxy endpoint access patterns (requests to /v1/sys/proxy with localhost or 127.0.0.1 targets) that might indicate prior exploitation. Verify that internal services are not exposing sensitive information without authentication, as defense-in-depth measure.