CVE-2026-58165

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-58165", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-29T16:03:38.521Z", "datePublished": "2026-06-30T15:49:12.654Z", "dateUpdated": "2026-11-08T14:06:47.920Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:06:47.920Z"}, "datePublic": "2026-06-26T00:00:00.000Z", "title": "OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation", "descriptions": [{"lang": "en", "value": "OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate function in controller/model/enrollment_manager.go verifies only that the target identity exists without performing authorization checks binding the caller to the target identity. Attackers can redeem the resulting one-time token through the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, yielding full administrative control of the controller and the zero-trust overlay it manages."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "Missing Authorization", "type": "CWE"}]}], "affected": [{"vendor": "openziti", "product": "ziti", "defaultStatus": "unaffected", "packageURL": "pkg:github/openziti/ziti", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.0", "versionType": "semver"}, {"status": "unaffected", "version": "3027fdffd3e57884487b7c46e5e669cfbc8becdf", "versionType": "git"}], "repo": "https://github.com/openziti/ziti"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.7, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "references": [{"url": "https://github.com/openziti/ziti/issues/4010", "name": "Researcher Disclosure", "tags": ["technical-description", "exploit", "issue-tracking"]}, {"url": "https://github.com/openziti/ziti/pull/4013", "name": "Pull Request", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/openziti/ziti/commit/3027fdffd3e57884487b7c46e5e669cfbc8becdf", "name": "Fix Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/openziti-privilege-escalation-to-admin-via-unauthorized-enrollment-creation", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-01T03:55:57.538925Z", "id": "CVE-2026-58165", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-01T17:29:19.881Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-58165", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T03:55:57.538925Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-30T17:07:59.471Z"}}], "cna": {"tags": ["x_open-source"], "title": "OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/openziti/ziti", "vendor": "openziti", "product": "ziti", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.0"}, {"status": "unaffected", "version": "3027fdffd3e57884487b7c46e5e669cfbc8becdf", "versionType": "git"}], "packageURL": "pkg:github/openziti/ziti", "defaultStatus": "unaffected"}], "datePublic": "2026-06-26T00:00:00.000Z", "references": [{"url": "https://github.com/openziti/ziti/issues/4010", "name": "Researcher Disclosure", "tags": ["technical-description", "exploit", "issue-tracking"]}, {"url": "https://github.com/openziti/ziti/pull/4013", "name": "Pull Request", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/openziti/ziti/commit/3027fdffd3e57884487b7c46e5e669cfbc8becdf", "name": "Fix Commit", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/openziti-privilege-escalation-to-admin-via-unauthorized-enrollment-creation", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate function in controller/model/enrollment_manager.go verifies only that the target identity exists without performing authorization checks binding the caller to the target identity. Attackers can redeem the resulting one-time token through the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, yielding full administrative control of the controller and the zero-trust overlay it manages."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:06:47.920Z"}}}, "cveMetadata": {"cveId": "CVE-2026-58165", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:06:47.920Z", "dateReserved": "2026-06-29T16:03:38.521Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-06-30T15:49:12.654Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:github/openziti/ziti", "product": "ziti", "repo": "https://github.com/openziti/ziti", "vendor": "openziti", "versions": [{"lessThanOrEqual": "2.0.0", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "3027fdffd3e57884487b7c46e5e669cfbc8becdf", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate function in controller/model/enrollment_manager.go verifies only that the target identity exists without performing authorization checks binding the caller to the target identity. Attackers can redeem the resulting one-time token through the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, yielding full administrative control of the controller and the zero-trust overlay it manages."}, {"lang": "es", "value": "OpenZiti hasta la versi\u00f3n 2.0.0, corregido en el commit 3027fdf, contiene una vulnerabilidad de escalada de privilegios que permite a identidades autenticadas no administradoras con permisos de gesti\u00f3n de inscripci\u00f3n de grano fino crear inscripciones para cualquier identidad, incluyendo el administrador predeterminado, porque la funci\u00f3n ApplyCreate en controller/model/enrollment_manager.go verifica solo que la identidad objetivo existe sin realizar comprobaciones de autorizaci\u00f3n que vinculen al llamador con la identidad objetivo. Los atacantes pueden canjear el token de un solo uso resultante a trav\u00e9s del endpoint de inscripci\u00f3n de la API de cliente no autenticado para obtener un certificado de cliente que autentica como la identidad de administrador objetivo, lo que otorga control administrativo total del controlador y la superposici\u00f3n de confianza cero que gestiona."}], "id": "CVE-2026-58165", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-58165", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-01T03:55:57.538925Z", "version": "2.0.3"}}]}, "published": "2026-06-30T17:16:23.350", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/openziti/ziti/commit/3027fdffd3e57884487b7c46e5e669cfbc8becdf"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/openziti/ziti/issues/4010"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/openziti/ziti/pull/4013"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/openziti-privilege-escalation-to-admin-via-unauthorized-enrollment-creation"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2.0.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "3027fdffd3e57884487b7c46e5e669cfbc8becdf"}}], "enrichment": {"confidence": 87.0, "confidence_source": "matching", "scores": [{"score": 87.0, "source": "matching"}]}, "original": {"product": "ziti", "source": "cna", "vendor": "openziti"}, "product": "openziti", "vendor": "openziti"}], "created": "2026-06-30T17:30:15.287173+00:00", "updated": "2026-07-01T09:15:15.443469+00:00", "vendors": ["openziti", "openziti$PRODUCT$openziti"]}