Security readout for executives and security teams
Plain-English summary
CVE-2026-22819 affects Outray, an open-source ngrok alternative. Before version 0.1.5, a race condition could let an authenticated user, such as a free-plan user, obtain more subdomains than intended. Business impact is mainly quota bypass and potential service capacity or abuse concerns, not data theft based on the provided sources.
Executive priority
Treat as a moderate operational risk. Prioritize upgrading internet-facing or multi-tenant Outray deployments because the flaw can undermine quota controls and potentially affect availability. It is not presented by sources as a data compromise or actively exploited emergency.
Technical view
The issue is a CWE-366 race condition in main/apps/web/src/routes/api/$orgSlug/subdomains/index.ts. Missing database transaction locking around subdomain allocation can allow concurrent requests to exceed intended plan limits. CVSS is 5.9 with network access, low privileges, high attack complexity, no user interaction, low integrity impact, and high availability impact.
Likely exposure
Organizations are exposed if they run Outray versions earlier than 0.1.5, especially hosted instances with multi-tenant users or plan-based subdomain quotas. The issue requires an authenticated low-privilege user account. The sources do not indicate exposure in unrelated products or services.
Exploitation context
The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation. Exploitation depends on winning a race condition, reflected by high attack complexity. The practical concern is quota abuse that may create operational load or undermine plan enforcement.
Researcher notes
Analysis is limited to the CVE record, GitHub advisory, and fix commit. The core issue is missing transaction locking in the subdomain route before 0.1.5. Avoid assuming broader impact without reviewing deployment-specific quota design, authentication requirements, and whether public user registration is enabled.
Mitigation direction
- Upgrade Outray to version 0.1.5 or later.
- Review the linked upstream advisory and commit for vendor-confirmed details.
- If immediate upgrade is delayed, monitor unusual subdomain creation volume.
- Review plan-quota enforcement logs for abnormal concurrent allocation patterns.
Validation and detection
- Inventory all Outray deployments and record running versions.
- Confirm no instance is running a version earlier than 0.1.5.
- Check subdomain counts against expected account or plan limits.
- Review application logs for repeated near-simultaneous subdomain creation attempts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-366: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-22819 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H1.64.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.9MediumVector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/outray-tunnel/outray/security/advisories/GHSA-45hj-9x76-wp9gCVE reference · x_refsource_CONFIRM
- https://github.com/outray-tunnel/outray/commit/73e8a09575754fb4c395438680454b2ec064d1d6CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Race Condition within a Thread
Race Condition within a Thread represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.