6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22820

CVE-2026-22820: Outray cli is vulnerable to race conditions in tunnels creation

Outray openSource ngrok alternative. Prior to 0.1.5, a TOCTOU race condition vulnerability allows a user to exceed the set number of active tunnels in their subscription plan. This vulnerability is fixed in 0.1.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22820

CVE-2026-22820:

6.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
outray	npm	< 0.1.5	0.1.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Time-of-check Time-of-use (TOCTOU) race condition in the Outray tunnel registration endpoint. The root cause is the non-atomic nature of checking the user's current tunnel count and creating a new tunnel. The vulnerable code is located in the post handler for the /api/tunnel/register route in the file apps/web/src/routes/api/tunnel/register.ts.

The analysis of the patch commit 08c61495761349e7fd2965229c3faa8d7b1c1581 confirms this. The original code performs a redis.scard to get the active tunnel count, and if the count is below the limit, it proceeds to db.insert a new tunnel. An attacker can exploit this by sending multiple concurrent requests to register tunnels. These requests can all read the tunnel count before it is updated by any of the other requests, leading to the creation of more tunnels than the subscription plan allows.

The patch fixes this by wrapping the entire check-and-create logic within a database transaction (db.transaction) and using row-level locking (.for("update")) on the subscription and tunnel tables. This serializes the requests and ensures that each request operates on the most up-to-date data, preventing the race condition.

The vulnerable function is the post handler itself, which would appear in a runtime profile during exploitation.

Vulnerable functions

post

apps/web/src/routes/api/tunnel/register.ts

The `post` handler for the `/api/tunnel/register` route contains a time-of-check to time-of-use (TOCTOU) race condition. It first checks the number of active tunnels for a user from Redis (`redis.scard`) and then, if the limit is not reached, it creates a new tunnel record in the database (`db.insert`). Because these two operations are not atomic, multiple concurrent requests can pass the check before any of them have created the new tunnel, allowing a user to exceed their tunnel limit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.