CVE-2026-22820: Outray

Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days.

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.

Affected products

• Outray Outray: before 0.1.5 (fixed in 0.1.5)

Published 2026-01-14. Last modified 2026-06-17.