Live › vulnerability › CVE-2026-121734
ZaneOps 1.14.0 before 1.15.2 lacks project scoping on the preview environment deploy endpoint, so a workspace administrator can read another workspace's pending preview environment. An attacker who has a project slug and environment name, such as from public fork pull request comments, can retrieve plaintext environment variables and preview basic-auth credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 23:45 UTC. All times on this page are UTC.
Teams running ZaneOps 1.14.0 through 1.15.1 that use preview environments and have more than one workspace or untrusted workspace administrators. Preview environment variables and basic-auth credentials for other workspaces are readable by any workspace administrator who knows the project slug and environment name.
No product ranges from the sources yet.
Unknown from the sources.
1.15.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.
This page as .md · .json · in your agent: get_signal("CVE-2026-121734")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.