{"id":"CVE-2026-121734","kind":"vulnerability","aliases":["CVE-2026-121734"],"related":[],"title":"ZaneOps: workspace admins can read other workspaces' preview environment secrets","description":"ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.","summary":"ZaneOps 1.14.0 before 1.15.2 lacks project scoping on the preview environment deploy endpoint, so a workspace administrator can read another workspace's pending preview environment. An attacker who has a project slug and environment name, such as from public fork pull request comments, can retrieve plaintext environment variables and preview basic-auth credentials.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","preview-environments","self-hosted","zaneops"],"not_affected_if":["no-preview-environments","single-workspace","version-1.15.2-or-later"],"how_to_check":null,"fix":"- ZaneOps: upgrade to `1.15.2` or later.","status":"open","published_at":"2026-11-03T23:17:37+00:00","first_seen_at":"2026-11-03T23:45:15+00:00","triaged_at":"2026-11-03T23:45:40+00:00","updated_at":"2026-11-03T23:45:40+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-03T23:45:40Z","model":"claude-haiku-5-5","output":{"fix":"- ZaneOps: upgrade to `1.15.2` or later.","reach":"network","title":"ZaneOps: workspace admins can read other workspaces' preview environment secrets","impact":"high","summary":"ZaneOps 1.14.0 before 1.15.2 lacks project scoping on the preview environment deploy endpoint, so a workspace administrator can read another workspace's pending preview environment. An attacker who has a project slug and environment name, such as from public fork pull request comments, can retrieve plaintext environment variables and preview basic-auth credentials.","audience":"businesses","category":"other","nicknames":[],"who_cares":["zaneops","self-hosted","preview-environments"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Workspace admin reads other workspaces' plaintext environment variables and credentials","analyst_note":"","how_to_check":"- Check the installed ZaneOps version and confirm whether it falls in `1.14.0` through `1.15.1`.\n- Confirm whether preview environments are in use, since the flaw concerns pending preview environments.","plain_action":"","needs_analyst":false,"not_affected_if":["version-1.15.2-or-later","single-workspace","no-preview-environments"],"who_is_affected":"Teams running ZaneOps 1.14.0 through 1.15.1 that use preview environments and have more than one workspace or untrusted workspace administrators. Preview environment variables and basic-auth credentials for other workspaces are readable by any workspace administrator who knows the project slug and environment name.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000954,"input_tokens":4233,"output_tokens":1061,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121734':13A,16A '-2026':12A,15A '1.14.0':26B,80C '1.15.2':28B,82C 'admin':3A 'administr':41B,92C 'allow':89C 'anoth':44B,95C 'attack':51B,107C 'auth':77B,131C 'author':85C 'basic':76B,130C 'basic-auth':75B,129C 'bypass':86C 'comment':67B,121C 'contain':83C 'credenti':78B,132C 'cve':11A,14A 'deploy':36B 'endpoint':37B 'environ':9A,20B,35B,49B,58B,71B,100C,114C,125C 'fork':64B,118C 'host':23B 'lack':29B 'name':59B,115C 'pend':47B,98C 'plaintext':70B,124C 'preview':8A,19B,34B,48B,74B,99C,128C 'preview-environ':18B 'project':30B,55B,105C,111C 'public':63B,117C 'pull':65B,119C 'queri':102C 'read':5A,43B,94C 'request':66B,120C 'retriev':69B,123C 'reviewpreviewenvdeployapiview':103C 'scope':31B,106C 'secret':10A 'self':22B 'self-host':21B 'slug':56B,112C 'use':109C 'variabl':72B,126C 'vulner':87C 'without':104C 'workspac':2A,7A,40B,45B,91C,96C 'zaneop':1A,24B,25B,79C","nicknames":[],"mitigations":[],"who_affected":"Teams running ZaneOps 1.14.0 through 1.15.1 that use preview environments and have more than one workspace or untrusted workspace administrators. Preview environment variables and basic-auth credentials for other workspaces are readable by any workspace administrator who knows the project slug and environment name.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","previewenvironments","selfhosted","zaneops"],"campaign_type":null,"first_public_at":"2026-11-03T17:52:36+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121734","severity":null,"published_at":"2026-11-03T23:17:37+00:00","modified_at":"2026-11-03T23:17:37+00:00","first_seen_at":"2026-11-03T23:45:15+00:00","fetched_at":"2026-11-03T23:45:15+00:00","note":null}],"documents":[{"id":61684,"url":"https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61685,"url":"https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":61686,"url":"https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-11-03T17:52:36+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":61687,"url":"https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}