CVE-2026-27945

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27945", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-25T03:11:36.690Z", "datePublished": "2026-02-26T00:29:58.157Z", "dateUpdated": "2026-02-26T16:51:23.606Z"}, "containers": {"cna": {"title": "ZITADEL has potential SSRF via Actions", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.1, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.7", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.7"}, {"name": "https://github.com/zitadel/zitadel/releases/tag/v4.11.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.11.0"}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"version": ">= 2.59.0, < 4.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T00:33:02.177Z"}, "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. Zitadel's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF). Zitadel Actions expect responses according to specific schemas, which reduces the threat vector. The patch in version 4.11.1 resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied. Note that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasible. Please check the workaround section for alternative solutions if an upgrade to v4.x is not possible. If an upgrade is not possible, prevent actions from using unintended endpoints by setting network policies or firewall rules in one's own infrastructure. Note that this is outside of the functionality provided by Zitadel."}], "source": {"advisory": "GHSA-7777-fhq9-592v", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T16:50:58.527791Z", "id": "CVE-2026-27945", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:51:23.606Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27945", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T16:50:58.527791Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T16:51:14.388Z"}}], "cna": {"title": "ZITADEL has potential SSRF via Actions", "source": {"advisory": "GHSA-7777-fhq9-592v", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "zitadel", "product": "zitadel", "versions": [{"status": "affected", "version": ">= 2.59.0, < 4.11.1"}]}], "references": [{"url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v", "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.7", "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.7", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/zitadel/zitadel/releases/tag/v4.11.0", "name": "https://github.com/zitadel/zitadel/releases/tag/v4.11.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. Zitadel's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF). Zitadel Actions expect responses according to specific schemas, which reduces the threat vector. The patch in version 4.11.1 resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied. Note that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasible. Please check the workaround section for alternative solutions if an upgrade to v4.x is not possible. If an upgrade is not possible, prevent actions from using unintended endpoints by setting network policies or firewall rules in one's own infrastructure. Note that this is outside of the functionality provided by Zitadel."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-26T00:33:02.177Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27945", "state": "PUBLISHED", "dateUpdated": "2026-02-26T16:51:23.606Z", "dateReserved": "2026-02-25T03:11:36.690Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-26T00:29:58.157Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "zitadel", "vendor": "zitadel", "versions": [{"status": "affected", "version": ">= 2.59.0, < 4.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "73FC526B-2AFD-4993-8601-63B7BE3AE63D", "versionEndIncluding": "3.4.6", "versionStartIncluding": "2.59.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zitadel:zitadel:*:*:*:*:*:*:*:*", "matchCriteriaId": "13ECEC48-A3CD-4641-80F0-FA92B8317252", "versionEndExcluding": "4.11.1", "versionStartIncluding": "4.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. Zitadel's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF). Zitadel Actions expect responses according to specific schemas, which reduces the threat vector. The patch in version 4.11.1 resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied. Note that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasible. Please check the workaround section for alternative solutions if an upgrade to v4.x is not possible. If an upgrade is not possible, prevent actions from using unintended endpoints by setting network policies or firewall rules in one's own infrastructure. Note that this is outside of the functionality provided by Zitadel."}, {"lang": "es", "value": "ZITADEL es una plataforma de gesti\u00f3n de identidad de c\u00f3digo abierto. Zitadel Action V2 (introducida como vista previa temprana en 2.59.0, beta en 3.0.0 y GA en 4.0.0) es un enfoque basado en webhooks para permitir a los desarrolladores actuar sobre peticiones API a Zitadel y personalizar flujos como la emisi\u00f3n de un token. Las URL de destino de las acciones de Zitadel pueden apuntar a hosts locales, lo que potencialmente permite a los adversarios recopilar informaci\u00f3n de la red interna y conectarse a servicios internos. Cuando la URL apunta a un host local / direcci\u00f3n IP, un adversario podr\u00eda recopilar informaci\u00f3n sobre la estructura de la red interna, los servicios expuestos en hosts internos, etc. Esto a veces se denomina falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF). Las acciones de Zitadel esperan respuestas seg\u00fan esquemas espec\u00edficos, lo que reduce el vector de amenaza. El parche en la versi\u00f3n 4.11.1 resuelve el problema comprobando la URL de destino contra una lista de denegaci\u00f3n. Por defecto, localhost, resp. las IP de bucle invertido son denegadas. Tenga en cuenta que esta correcci\u00f3n solo se lanz\u00f3 en v4.x. Debido a la etapa (vista previa / beta) en la que se encontraba la funcionalidad en v2.x y v3.x, los cambios que se le han aplicado desde entonces y la gravedad, respectivamente el vector de amenaza real, una retrocompatibilidad a las versiones correspondientes no fue factible. Consulte la secci\u00f3n de soluci\u00f3n alternativa para soluciones alternativas si una actualizaci\u00f3n a v4.x no es posible. Si una actualizaci\u00f3n no es posible, evite que las acciones utilicen puntos finales no deseados configurando pol\u00edticas de red o reglas de cortafuegos en la propia infraestructura. Tenga en cuenta que esto est\u00e1 fuera de la funcionalidad proporcionada por Zitadel."}], "id": "CVE-2026-27945", "lastModified": "2026-06-17T10:27:57.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.1, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27945", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T16:50:58.527791Z", "version": "2.0.3"}}]}, "published": "2026-02-26T01:16:25.800", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.7"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/zitadel/zitadel/releases/tag/v4.11.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-7777-fhq9-592v"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.59.0,4.11.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "zitadel", "source": "cna", "vendor": "zitadel"}, "product": "zitadel", "vendor": "zitadel"}], "analysis": {"en": {"generated_at": "2026-04-18T19:34:34.904198+00:00", "value": {"mitigation_remediation": ["Upgrade to Zitadel\u202f4.11.1 or later so that outgoing action URLs are validated against a denylist that blocks localhost and loopback addresses.", "If an upgrade is not possible, block outbound traffic from the Zitadel instance to private or local IP ranges using network policies or firewall rules, preventing actions from reaching internal endpoints.", "Review existing Action\u202fV2 configurations and remove or modify any that target internal hosts or localhost URLs; if the feature is unused, disable Action\u202fV2 entirely to eliminate the SSRF vector."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Zitadel, an open\u2011source identity management platform, from Action\u202fV2 preview releases beginning at version\u202f2.59.0, through the beta releases in the 3.x series, and up to the GA releases of the 4.x line through version\u202f4.11.0. The issue is resolved in version\u202f4.11.1 and later, where outbound action URLs are validated against a denylist that blocks localhost and loopback IPs. Earlier 4.x releases, as well as all 3.x and 2.x iterations, do not contain the fix.", "description_and_impact": "Zitadel\u2019s Action\u202fV2 allows developers to configure webhooks that trigger when identity events occur. The configured target URL for an action can point to any host, including localhost or private IP ranges. When an action is executed, the Zitadel server performs an outbound HTTP request to the supplied URL. This behavior can be abused as a server\u2011side request forgery, enabling an attacker to probe internal services, discover network topology, or access restricted resources that are otherwise unreachable from the public internet. The vulnerability is mitigated by the fact that the server expects responses to match specific schemas, limiting the usefulness of arbitrary payloads, but discovery and reconnaissance remain possible.", "risk_and_exploitability": "The CVSS score of 2.1 indicates low overall severity, and the EPSS score of less than 1% reflects a very low probability that exploit attempts are currently observed. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to create or modify Action\u202fV2 configurations to exploit the SSRF vector. Once a vulnerable action exists, the attacker can use the resulting outbound request to collect information about internal hosts or services. The impact is primarily limited to internal reconnaissance and potential access to isolated services, rather than full system compromise or arbitrary code execution."}}}}, "created": "2026-02-26T13:10:21.273196+00:00", "updated": "2026-04-18T19:45:08.959567+00:00", "vendors": ["zitadel", "zitadel$PRODUCT$zitadel"]}