CVE-2026-22820 Outray cli is vulnerable to race conditions in tunnels creation
Attackers can exploit a race condition to create more tunnels than allowed by their subscription plan, bypassing usage limits.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22820?
CVE-2026-22820 is a medium-severity vulnerability in akinloluwami outray, published on 14 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.
Weakness: CWE-367
Which versions are affected by CVE-2026-22820?
2 open source packages ship an affected version, including outray. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
outray npm | All versions | 0.1.5 |
outray npm | All versions | 0.1.5 |
Products include Outray Outray.
How do I fix CVE-2026-22820?
Upgrade outray to 0.1.5 or later.
Is CVE-2026-22820 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22820 exists.
Other vulnerabilities in akinloluwami outray
Sources
Also known as GHSA-3pqc-836w-jgr7.