---
id: "CVE-2026-121734"
kind: "vulnerability"
aliases: ["CVE-2026-121734"]
title: "ZaneOps: workspace admins can read other workspaces' preview environment secrets"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "preview-environments", "self-hosted", "zaneops"]
not_affected_if: ["no-preview-environments", "single-workspace", "version-1.15.2-or-later"]
published_at: "2026-11-03T23:17:37+00:00"
first_seen_at: "2026-11-03T23:45:15+00:00"
updated_at: "2026-11-03T23:45:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121734", "first_seen_at": "2026-11-03T23:45:15+00:00"}]
---

# ZaneOps: workspace admins can read other workspaces' preview environment secrets

ZaneOps 1.14.0 before 1.15.2 lacks project scoping on the preview environment deploy endpoint, so a workspace administrator can read another workspace's pending preview environment. An attacker who has a project slug and environment name, such as from public fork pull request comments, can retrieve plaintext environment variables and preview basic-auth credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Fix

- ZaneOps: upgrade to `1.15.2` or later.

## Timeline

- 2026-11-03T23:45:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121734

## Documents

- [advisory] Vendor advisory: github.com https://github.com/zane-ops/zane-ops/security/advisories/GHSA-r87v-8542-wx9q
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zaneops-1.14.0-before-1.15.2-cross-workspace-information-disclosure-via-reviewpreviewenvdeployapiview
- [fix] Patch: github.com https://github.com/zane-ops/zane-ops/commit/0f3e30403a605dc155a664bc70722c74159a6494
- [fix] Release notes: github.com https://github.com/zane-ops/zane-ops/releases/tag/v1.15.2

## From the sources

ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the project slug and environment name from public fork pull request comments to retrieve plaintext environment variables and preview basic-auth credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_