CVE-2026-27945
SSRF Vulnerability in Zitadel Actions Allows Internal Network Access
Publication date: 2026-02-26
Last updated on: 2026-03-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zitadel | zitadel | From 2.59.0 (inc) to 3.4.6 (inc) |
| zitadel | zitadel | From 4.0.0 (inc) to 4.11.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-27945 is a Server-Side Request Forgery (SSRF) vulnerability in Zitadel's Action V2 feature, which is a webhook-based mechanism allowing developers to customize API request flows such as token issuance."}, {'type': 'paragraph', 'content': 'The vulnerability occurs because Zitadel Action target URLs can point to local hosts or internal IP addresses, enabling attackers to perform SSRF attacks by making the system send requests to internal services.'}, {'type': 'paragraph', 'content': 'This can allow an adversary to gather information about the internal network structure and access internal services that are not exposed externally.'}, {'type': 'paragraph', 'content': 'Although Zitadel expects responses to conform to specific schemas, which limits the attack surface, the risk remains significant.'}, {'type': 'paragraph', 'content': 'The vulnerability was patched in version 4.11.1 by implementing a denylist blocking requests to localhost and loopback IP addresses.'}] [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with high privileges within the system to gather information about your internal network structure and access internal services that are not normally exposed externally.
The impact is limited to low confidentiality and integrity risks, with no effect on system availability.
There is no need for user interaction, but the attacker must have high privileges to exploit this vulnerability.
Overall, the vulnerability could lead to limited disclosure of internal network information, which might aid further attacks or reconnaissance.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves Zitadel Action V2 making requests to local hosts or internal IP addresses, which can be detected by monitoring network traffic for such internal requests originating from Zitadel.'}, {'type': 'paragraph', 'content': 'To detect potential exploitation, you can inspect logs or network traffic for outbound HTTP requests from Zitadel to localhost or internal IP ranges.'}, {'type': 'paragraph', 'content': 'Suggested commands include using network monitoring tools or command-line utilities to capture and filter such traffic, for example:'}, {'type': 'list_item', 'content': "Using tcpdump to capture HTTP requests to local IPs: tcpdump -i <interface> 'dst net 127.0.0.0/8 or dst net 10.0.0.0/8 or dst net 192.168.0.0/16'"}, {'type': 'list_item', 'content': 'Using curl or wget to test if Zitadel Actions are configured to call local endpoints.'}, {'type': 'list_item', 'content': 'Review Zitadel Action configurations or logs for URLs pointing to localhost or internal IP addresses.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary mitigation is to upgrade Zitadel to version 4.11.1 or later, where the vulnerability is patched by implementing a denylist blocking requests to localhost and loopback IP addresses.'}, {'type': 'paragraph', 'content': 'If upgrading is not possible, immediate steps include enforcing network policies or firewall rules to prevent Zitadel Actions from accessing unintended internal endpoints such as localhost or internal IP ranges.'}, {'type': 'paragraph', 'content': "These mitigations are external to Zitadel's functionality and should be implemented within your infrastructure to block SSRF attempts."}] [1]