ZimaOS is a fork of CasaOS

CVE-2026-28798 is an SSRF-style proxy abuse in ZimaOS's /v1/sys/proxy endpoint that can turn the web UI into a bounce point toward localhost-only services. The NVD description says versions *prior to 1.5.3* are affected; the GitHub advisory metadata says <=1.5.0, so defenders should treat *all 1.5.x before 1.5.3 as suspect* until the vendor clarifies the range. The exploit condition that matters is not just 'network reachable' but *Internet reachable through a Cloudflare Tunnel*.

The vendor's CRITICAL 9.0 label is too high for enterprise prioritization because the prerequisite chain is unusually restrictive: niche product, intentional remote publishing, and a Cloudflare Tunnel-backed exposure pattern. If that condition exists, the bug is ugly because it strips away localhost trust boundaries and may expose admin APIs or sensitive local services without auth; but most real deployments never satisfy the exposure prerequisite, which is why this lands as HIGH, not CRITICAL.

Why this verdict

• Downgrade for reachability friction: exploitation is not 'any Internet host'; it requires a ZimaOS deployment that is *deliberately* exposed through a Cloudflare Tunnel, which is a major population reducer.
• Still unauthenticated remote on exposed systems: once that edge case exists, the attacker needs no account and can drive the proxy endpoint directly from the Internet.
• PoC exists, but pressure is low: vendor-linked Exploit.py lowers attacker effort, yet EPSS is only 0.08% and there is no KEV or confirmed campaign evidence.
• Niche product matters: ZimaOS is a specialized NAS/home-server OS, not a broad enterprise platform with huge exposed census numbers.
• Blast radius is host-local, not automatically estate-wide: the vulnerability compromises localhost trust on the appliance, but impact depends on what internal services are present and how much they trust loopback.

Why not higher?

This is not a clean Internet-wide pre-auth exploit against a commonly exposed enterprise product. The Cloudflare Tunnel prerequisite effectively implies a consciously published appliance, which narrows both victim population and exploit reliability. There is also no authoritative evidence of widespread exploitation or KEV inclusion.

Why not lower?

For the subset of hosts that *are* exposed this way, the bug is nasty: unauthenticated remote access can punch through to internal-only services and admin APIs. The presence of a vendor-linked PoC means defenders should assume exposed systems are testable by adversaries now, not hypothetically later.

1. Unpublish the ZimaOS UI — Remove the public hostname or disable the Cloudflare Tunnel route that exposes the ZimaOS web interface. This is the fastest risk kill-switch and, for a HIGH verdict, should be deployed within 30 days unless business need forces external access.
2. Put Cloudflare Access in front — Require identity-aware access controls on any published hostname so anonymous traffic never reaches /v1/sys/proxy. If remote access must remain, deploy this compensating gate within 30 days.
3. Block the proxy path upstream — Add a WAF/reverse-proxy rule that denies requests to /v1/sys/proxy from untrusted clients. This is a practical temporary barrier when you cannot remove external publishing immediately; deploy within 30 days.
4. Restrict admin reach to VPN-only — Move management access behind WireGuard/Tailscale/VPN instead of direct public hostname exposure. This removes the Internet attacker position entirely and should be implemented within 30 days if patch rollout lags.
5. Review localhost-trusting services — Inventory services bound to 127.0.0.1 on the appliance and identify any admin endpoints that trust loopback implicitly. This contains post-exploit blast radius and should be completed within 30 days.

Run this on the ZimaOS target host over local shell or SSH. Invoke with sudo bash ./check-zimaos-cve-2026-28798.sh; root is recommended so the script can inspect processes and common config paths. It checks the local ZimaOS version and whether cloudflared appears present/running, then prints VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check-zimaos-cve-2026-28798.sh
# Detect likely exposure state for CVE-2026-28798 on ZimaOS.
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

TARGET_FIXED="1.5.3"

verlt() {
  # returns 0 if $1 < $2
  [ "$1" = "$2" ] && return 1
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [ "$first" = "$1" ]
}

get_version() {
  local v=""

  if [ -r /etc/os-release ]; then
    v=$(awk -F= '/^VERSION_ID=/{gsub(/"/,"",$2); print $2}' /etc/os-release | head -n1)
  fi

  if [ -z "$v" ] && [ -r /etc/issue ]; then
    v=$(grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' /etc/issue | head -n1)
  fi

  if [ -z "$v" ] && command -v zimaos >/dev/null 2>&1; then
    v=$(zimaos --version 2>/dev/null | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
  fi

  printf '%s' "$v"
}

cloudflared_present=false
cloudflared_running=false
cloudflared_config=false

if command -v cloudflared >/dev/null 2>&1; then
  cloudflared_present=true
fi

if pgrep -fa cloudflared >/dev/null 2>&1; then
  cloudflared_running=true
fi

for p in \
  /etc/cloudflared/config.yml \
  /etc/cloudflared/config.yaml \
  /root/.cloudflared/config.yml \
  /root/.cloudflared/config.yaml \
  /home/*/.cloudflared/config.yml \
  /home/*/.cloudflared/config.yaml
  do
  if [ -e "$p" ]; then
    cloudflared_config=true
    break
  fi
done

version=$(get_version)

if [ -z "$version" ]; then
  echo "UNKNOWN - could not determine ZimaOS version; cloudflared_present=$cloudflared_present cloudflared_running=$cloudflared_running cloudflared_config=$cloudflared_config"
  exit 2
fi

if verlt "$version" "$TARGET_FIXED"; then
  if [ "$cloudflared_running" = true ] || [ "$cloudflared_config" = true ] || [ "$cloudflared_present" = true ]; then
    echo "VULNERABLE - ZimaOS version $version is older than $TARGET_FIXED and cloudflared appears present/running/configured"
    exit 1
  else
    echo "UNKNOWN - ZimaOS version $version is older than $TARGET_FIXED but no local cloudflared evidence was found; verify remote publishing manually"
    exit 2
  fi
else
  echo "PATCHED - ZimaOS version $version is >= $TARGET_FIXED"
  exit 0
fi

Sources

1. NVD CVE-2026-28798
2. GitHub advisory GHSA-vqqj-f979-8c8m
3. ZimaOS 1.5.3 release
4. ZimaOS repository
5. Cloudflare Tunnel published applications
6. CISA Known Exploited Vulnerabilities catalog
7. FIRST EPSS overview
8. CVEFind EPSS mirror for CVE-2026-28798