Architecture, reliability & security assurance — found from sitemap — Firezone

Cited by

Facts read from this source

• Advisories official source Report an error

  “The official source for security vulnerabilities disclosed in Firezone.”

• Advisories rss Report an error

  “Published advisories RSS”

• Vulnerability disclosure Report an error

  “Found a vulnerability? See reporting a vulnerability for how to disclose it privately.”

• Advisory fz 2026 009 Report an error

  “Gateway token file readable by local users On Linux Gateways prior to 1.6.3, the authenticate command did not set the permissions of the token file it wrote, so in some setups any local user could read the Gateway's token. Component: Gateway Fixed in: 1.6.3”

• Advisory fz 2026 008 Report an error

  “Gateway forwards traffic to arbitrary hosts when a Client supplies out-of-range proxy IPs Gateways from 1.4.6 through 1.6.0 installed the DNS Resource proxy IPs chosen by a Client without checking that they fall inside the reserved ranges, so a Client authorized for a DNS Resource could reach any host the Gateway can reach, subject only to that Resource's port filters. Component: Gateway Fixed in: 1.6.1”

• Advisory fz 2026 007 Report an error

  “Email sign-in one-time code could be brute-forced, allowing account takeover Firezone's email sign-in one-time code had insufficient entropy and the verification endpoint enforced no per-code attempt limit, so a distributed attacker could brute-force a live code within its 15-minute window and sign in as another user. The issue has been resolved in the managed service; no action is required. Component: Portal Fixed in: Resolved in the managed service”

• Advisory fz 2026 006 Report an error

  “Windows device ID file is world-readable, allowing device verification bypass On Windows Clients prior to 1.5.13, the device ID file was readable by any local user, so its contents could be copied to another machine to bypass device verification policies. Component: Windows Client Fixed in: 1.5.13”

• Advisory fz 2026 005 Report an error

  “Windows GUI Client reads configuration from user-writable locations Windows GUI Clients prior to 1.5.13 stored their advanced settings in a user-writable directory and read MDM policy from the per-user registry hive, letting any same-user process change how the privileged tunnel connects. Component: Windows GUI Client Fixed in: 1.5.13”

• Advisory fz 2026 004 Report an error

  “Linux GUI Client stores its configuration in a user-writable location Linux GUI Clients prior to 1.5.13 stored their advanced settings in a directory under the user's home that any same-user process could modify, influencing how the privileged tunnel connects. Component: Linux GUI Client Fixed in: 1.5.13”

• Advisory fz 2026 003 Report an error

  “Windows GUI Client named pipes accept connections from other local processes Windows GUI Clients prior to 1.5.13 created their tunnel and GUI named pipes without package-scoped access control, letting other local processes drive the privileged tunnel service, change settings, or hijack deep-link handoff. Component: Windows GUI Client Fixed in: 1.5.13”

• Advisory fz 2026 002 Report an error

  “Linux tunnel service IPC socket accepts connections from any same-user process Linux GUI Clients prior to 1.5.13 authorized peers on the tunnel service IPC socket only by group membership, letting any process running as the desktop user drive the privileged tunnel and change Client settings. Component: Linux GUI Client Fixed in: 1.5.13”

• Advisory fz 2026 001 Report an error

  “macOS Client lets local processes modify its configuration macOS Clients from 1.4.15 through 1.5.15 stored their configuration in a UserDefaults domain writable by any unprivileged local process, allowing the Client's settings to be tampered with. Clients with configuration forced via MDM are not affected. Component: macOS Client Fixed in: 1.5.16”

• Free tier Report an error

  “Free for up to 6 users. No credit card required.”

• Wireguard based Report an error

  “Zero trust access built on WireGuard®.”

• Use cases Report an error

  “Mesh VPN Remote access Site to site VPN Secure access to SaaS Full-tunnel VPN Internet of Things”

• Client platforms Report an error

  “Component: Windows Client Fixed in: 1.5.13”

• Trust center Report an error

  “Trust Center”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The DevOps Engineer Access model & connectivity
• The DevOps Engineer Deployment, API & administration
• The DevOps Engineer Architecture, reliability & security assurance
• The DevOps Engineer Pricing transparency
• The IT Lead Access model & connectivity
• The IT Lead Deployment, API & administration
• The IT Lead Architecture, reliability & security assurance
• The MSP Technician Access model & connectivity
• The MSP Technician Deployment, API & administration
• The MSP Technician Architecture, reliability & security assurance
• The Operations Manager Access model & connectivity
• The Operations Manager Deployment, API & administration
• The Operations Manager Architecture, reliability & security assurance
• The Information Security Officer Access model & connectivity
• The Information Security Officer Architecture, reliability & security assurance
• The Skeptic Access model & connectivity
• The Skeptic Deployment, API & administration
• The Skeptic Architecture, reliability & security assurance