CVE-2026-22820
📋 TL;DR
A TOCTOU race condition vulnerability in Outray (an open-source ngrok alternative) allows authenticated users to bypass subscription limits and create more active tunnels than their plan permits. This affects all Outray users with subscription plans prior to version 0.1.5. The vulnerability requires user authentication but doesn't require administrative privileges.
💻 Affected Systems
- Outray
📦 What is this software?
Outray by Outray
⚠️ Risk & Real-World Impact
Worst Case
Users could create unlimited tunnels beyond their paid subscription limits, potentially causing resource exhaustion, service degradation, or financial impact to the service provider.
Likely Case
Users exceeding their tunnel limits, causing minor resource consumption increases and potential billing discrepancies.
If Mitigated
Proper rate limiting and subscription enforcement prevents any tunnel limit bypass.
🎯 Exploit Status
Exploitation requires race condition timing and authenticated user access. No public exploits have been reported.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.5
Vendor Advisory: https://github.com/outray-tunnel/outray/security/advisories/GHSA-3pqc-836w-jgr7
Restart Required: Yes
Instructions:
1. Stop Outray service. 2. Update to version 0.1.5 via package manager or manual installation. 3. Restart Outray service. 4. Verify version with 'outray --version'.
🔧 Temporary Workarounds
Rate Limiting
allImplement external rate limiting on tunnel creation requests
# Use nginx or similar proxy with rate limiting
limit_req_zone $binary_remote_addr zone=tunnel:10m rate=1r/s;
limit_req zone=tunnel burst=5 nodelay;
🧯 If You Can't Patch
- Implement strict monitoring on tunnel creation rates per user
- Enforce subscription limits at the load balancer or proxy level
🔍 How to Verify
Check if Vulnerable:
Check if running Outray version < 0.1.5 with 'outray --version'Check Version:
outray --versionVerify Fix Applied:
Confirm version is 0.1.5 or higher and test tunnel creation respects subscription limits📡 Detection & Monitoring
Log Indicators:
- Multiple tunnel creation requests from same user in rapid succession
- User exceeding documented tunnel limits
Network Indicators:
- Unusual spike in tunnel establishment traffic
- Multiple simultaneous tunnel connections from single user
SIEM Query:
source="outray.log" AND "tunnel created" | stats count by user | where count > subscription_limit