CVE-2026-40304: Netfoundry Zrok Auth Bypass Vulnerability

CVE-2026-40304 Overview

CVE-2026-40304 is an improper access control vulnerability in zrok, a software platform for sharing web services, files, and network resources. Prior to version 2.0.1, the unaccess handler (controller/unaccess.go) contains a logical error in its ownership guard that allows non-admin users to delete global frontends without proper authorization verification.

When a frontend record has environment_id = NULL (the marker for admin-created global frontends), the ownership condition short-circuits to false and allows the deletion to proceed without any ownership verification. This flaw enables a non-admin user who knows a global frontend token to call DELETE /api/v2/unaccess with any of their own environment IDs and permanently delete the global frontend, taking down all public shares routed through it.

Critical Impact

A non-privileged user can permanently delete admin-created global frontends, causing denial of service for all public shares routed through the affected frontend.

Affected Products

• Netfoundry Zrok versions prior to 2.0.1

Discovery Timeline

• 2026-04-17 - CVE-2026-40304 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-40304

Vulnerability Analysis

This vulnerability is classified as Improper Access Control (CWE-284), where the application fails to properly restrict access to a sensitive resource deletion operation. The core issue lies in the ownership verification logic within the unaccess handler function.

The flaw is particularly significant because global frontends are critical infrastructure components in zrok deployments. These admin-created frontends serve as routing endpoints for multiple public shares, making their unauthorized deletion a high-impact availability issue.

The vulnerability can be exploited over the network by authenticated low-privileged users. While the attack requires some knowledge of global frontend tokens and elevated complexity, successful exploitation results in complete availability loss for all services routed through the affected frontend.

Root Cause

The root cause is a logical error in the ownership guard within controller/unaccess.go. When checking if a user has permission to delete a frontend, the code evaluates whether the frontend's environment_id matches the requesting user's environment. However, for global frontends created by administrators, the environment_id is set to NULL.

The ownership condition incorrectly short-circuits when environment_id = NULL, returning false instead of denying access. This causes the guard to fail open, allowing the deletion to proceed without verifying that the requesting user has administrative privileges to manage global frontends.

Attack Vector

The attack vector is network-based, requiring an authenticated but non-privileged user account. The attacker must:

1. Obtain knowledge of a global frontend token (through observation, enumeration, or other means)
2. Have a valid environment ID associated with their account
3. Send a crafted DELETE request to /api/v2/unaccess endpoint with the target global frontend token and their own environment ID

The vulnerability exploits the logical flaw where the NULL environment_id comparison causes the ownership check to bypass authorization entirely. When the deletion proceeds, all public shares routed through that global frontend become inaccessible, causing service disruption for potentially many users.

Detection Methods for CVE-2026-40304

Indicators of Compromise

• Unexpected deletion of global frontend records from the zrok database
• API logs showing DELETE /api/v2/unaccess requests from non-admin user accounts targeting global frontends
• Sudden unavailability of public shares that were previously functioning correctly
• Database audit logs indicating frontend records with NULL environment_id being removed

Detection Strategies

• Monitor API access logs for DELETE requests to /api/v2/unaccess endpoints, particularly from non-administrative accounts
• Implement alerting for any modification or deletion of frontend records where environment_id = NULL
• Review authentication and authorization logs for suspicious access patterns involving frontend management operations
• Deploy SentinelOne Singularity Platform for real-time threat detection and behavioral analysis of API abuse patterns

Monitoring Recommendations

• Enable detailed audit logging for all frontend management API operations
• Configure database-level triggers or monitoring to alert on deletions of global frontend records
• Implement rate limiting and anomaly detection for the /api/v2/unaccess endpoint
• Establish baseline metrics for frontend availability to quickly identify unauthorized deletions

How to Mitigate CVE-2026-40304

Immediate Actions Required

• Upgrade zrok to version 2.0.1 or later immediately to patch the vulnerability
• Audit recent API logs for any suspicious DELETE /api/v2/unaccess requests from non-admin users
• Verify the integrity of all global frontend configurations and restore any that may have been deleted
• Restrict network access to the zrok API to trusted sources while patching is in progress

Patch Information

Netfoundry has released version 2.0.1 of zrok which addresses this vulnerability. The patch corrects the ownership guard logic in controller/unaccess.go to properly deny deletion requests when environment_id = NULL unless the requesting user has administrative privileges.

For detailed patch information, refer to the GitHub Zrok Release v2.0.1 and the GitHub Security Advisory GHSA-3jpj-v3xr-5h6g.

Workarounds

• Restrict access to the /api/v2/unaccess endpoint at the network or reverse proxy level to admin users only
• Implement additional authorization middleware to validate admin privileges for any operations affecting global frontends
• Deploy API gateway policies that require explicit admin authentication for frontend deletion operations
• Consider temporarily disabling the unaccess API endpoint until the patch can be applied

# Example: Restrict access to unaccess endpoint via nginx
# Add to nginx configuration for zrok API proxy
location /api/v2/unaccess {
    # Restrict to admin IP ranges only
    allow 10.0.0.0/8;
    deny all;
    
    proxy_pass http://zrok-backend;
}