CVE-2026-85057

Deferred Deferred - Pending Action

JavaScript Code Execution in ZITADEL Actions

Publication date: 2026-09-24

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-05

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-85057

EUVD

EUVD-2026-86322

Affected Vendors & Products

Vendor	Product	Version / Range
zitalel	actions_v1	From 3.0.0 (inc) to 3.4.13 (inc)
zitalel	actions_v1	4.16.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

ZITADEL is an open source identity management platform. This vulnerability exists in Actions V1 versions from 3.0.0 until 3.4.13 and 4.16.1. It allows an organization Action author with specific permissions to run JavaScript code at OIDC, SAML, and login-flow trigger points. The issue is that the goja Node-compatible require() registry is enabled without restricting its filesystem source loader, allowing access to files readable by the ZITADEL server process.

Detection Guidance

Check ZITADEL server logs for suspicious Actions V1 JavaScript executions. Review files loaded by Actions V1 for unauthorized access. Verify permissions of users with ORG_OWNER, org.action.write, or org.flow.write to detect misuse.

Impact Analysis

An attacker with ORG_OWNER, org.action.write, or org.flow.write permissions could exploit this to disclose sensitive files, including configuration files and secrets like credentials stored in ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH. Recovered bootstrap credentials could also enable escalation from an organization administrator to an instance administrator.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements and HIPAA's security and privacy rules. Exposure of credentials or configuration files may result in non-compliance with these regulations.

Mitigation Strategies

Upgrade ZITADEL to versions 3.4.13 or 4.16.1 or later. Restrict Actions V1 permissions to only necessary users. Audit existing Actions V1 for unauthorized scripts or file accesses.

Hi! I’m here to help you understand CVE-2026-85057. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70