CVE-2026-22820

CVE-2026-22820 affects the Outray open-source CLI (an ngrok-like tool). The vulnerability is a TOCTOU race condition in tunnel creation that can allow a user to bypass the plan’s active-tunnels limit, potentially creating more tunnels than allowed. The issue occurs during registration: the code c...