6.5

CVE-2026-27945: zitadel Server-Side Request Forgery (SSRF)

CVSS: 6.5v3.1MediumAnalyzed
AliasesGHSA-7777-fhq9-592vGO-2026-4574CGA-34c3-7hrc-8xpw
Published 26-02-2026Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2026-27945 is a medium (CVSS 6.5) Server-Side Request Forgery (SSRF) vulnerability in zitadel. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.8% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.38%
0%100%
Low · +0.16 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:21483-1SUSE-SU-2026:1042-1CGA-M636-FC7J-9FQC

Timeline

  1. 26-02-2026
    PublishedVulnerability first disclosed.
  2. 26-02-2026
    Last modifiedVulnerability information updated.

Description

ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. Zitadel's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF). Zitadel Actions expect responses according to specific schemas, which reduces the threat vector. The patch in version 4.11.1 resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied. Note that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasible. Please check the workaround section for alternative solutions if an upgrade to v4.x is not possible. If an upgrade is not possible, prevent actions from using unintended endpoints by setting network policies or firewall rules in one's own infrastructure. Note that this is outside of the functionality provided by Zitadel.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.38%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

+0.16 pp

From 0.23% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard1 product
  • zitadel-3All versions (No fix recorded)
Github.com/zitadel1 product
  • zitadel< 1.80.0-v2.20.0.20260225053328-b2532e966621
Github.com/zitadel/zitadel1 product
  • v2≥ 2.59.0, < 4.11.1 | < 1.80.0-v2.20.0.20260225053328-b2532e966621
Zitadel1 product
  • zitadel≥ 2.59.0, < 4.11.1 | ≥ 2.59.0, ≤ 3.4.6 | ≥ 4.0.0, < 4.11.1

4 vendors · 4 products

References

8 links