CVE-2026-28798: SSRF Proxy Flaw in ZimaOS Before 1.5.3

CVE-2026-28798 is a critical (CVSS 9.0) server side request forgery in ZimaOS, the CasaOS fork, before version 1.5.3. A proxy endpoint can be used through a Cloudflare Tunnel to reach internal localhost services without authentication. Upgrade to 1.5.3 or later.

What's affected

The record says ZimaOS before 1.5.3 is affected, and 1.5.3 is the patched version. The GitHub advisory lists affected versions as 1.5.0 and earlier.

The issue applies to devices reachable from the internet through a Cloudflare Tunnel. The endpoint is /v1/sys/proxy.

How to check if you're exposed

Check the version in the ZimaOS settings page and compare it with 1.5.3. Then check whether you publish the device through a Cloudflare Tunnel, and which hostnames it serves.

What to do now

1. Upgrade ZimaOS to 1.5.3 or later.
2. Review your Cloudflare Tunnel configuration and remove public routes to the device if you do not need them.
3. Put an access policy such as Cloudflare Access in front of any tunnel hostname that serves the admin interface.
4. Review internal services bound to localhost and rotate any tokens that may have been exposed.
5. Check device logs for unfamiliar requests to the proxy path.

Why it matters

This is CWE-918, server side request forgery. A proxy feature made for the local interface also worked for outside requests, so an outsider could make the device talk to services that are meant to listen only on the machine itself.

Services bound to localhost often have no login because they trust the network position. SSRF breaks that assumption. The advisory lists information disclosure, access to admin APIs and discovery of internal services as possible impacts.

The attack complexity in the CVSS vector is high because the device must be exposed in a specific way. The record does not mark the CVE as exploited in the wild.

Quick check

Sources

• GitHub advisory GHSA-vqqj-f979-8c8m
• ZimaOS 1.5.3 release

Last reviewed: 19 October 2026.