Executive brief
Outray CLI is a command-line tool for creating secure network tunnels with usage limits based on subscription plans. A race condition flaw allows attackers to create more tunnels than their subscription plan permits by submitting multiple tunnel registration requests simultaneously, bypassing billing controls and consuming server resources without additional charges.
Technical details
A TOCTOU (time-of-check time-of-use) race condition exists in the /tunnel/register endpoint (apps/web/src/routes/api/tunnel/register.ts). The vulnerable code checks the active tunnel count via Redis, validates against the subscription limit, and then inserts a new tunnel record—all without transactional locking. When multiple parallel requests arrive during the brief window between the limit check and database insert, each request sees the same (outdated) active count, allowing all to pass validation and create tunnels, thus exceeding the allowed limit. The root cause is lack of database transaction locking; fix involves wrapping the subscription and tunnel checks in a database transaction with row-level `.for("update")` clauses to serialize concurrent requests. Affected versions prior to 0.1.5; a patch adding transaction locking has been committed (08c61495761349e7fd2965229c3faa8d7b1c1581).
Affected products
- Outray Outray CLI before 0.1.5
Timeline
- 2026-01-13: disclosed: GHSA-3pqc-836w-jgr7 published
- 2026-01-13: patched: Commit 08c61495761349e7fd2965229c3faa8d7b1c1581 adds transaction locking to prevent race conditions