2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27945

CVE-2026-27945: ZITADEL has potential SSRF via Actions

ZITADEL is an open source identity management platform. Zitadel Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. Zitadel's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF). Zitadel Actions expect responses according to specific schemas, which reduces the threat vector. The patch in version 4.11.1 resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied. Note that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasible. Please check the workaround section for alternative solutions if an upgrade to v4.x is not possible. If an upgrade is not possible, prevent actions from using unintended endpoints by setting network policies or firewall rules in one's own infrastructure. Note that this is outside of the functionality provided by Zitadel.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27945

CVE-2026-27945:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/zitadel/zitadel/v2	go	>= 2.59.0, < 4.11.1	4.11.1
github.com/zitadel/zitadel/v2	go	< 1.80.0-v2.20.0.20260225053328-b2532e966621	1.80.0-v2.20.0.20260225053328-b2532e966621

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) in the ZITADEL Actions feature. The root cause is the lack of validation on the target URLs for webhooks, which can be configured as part of an Action. An attacker could set the webhook URL to a local or internal network address (e.g., localhost, 127.0.0.1).

The analysis of the patch commit reveals that the fix was implemented in two main places:

Configuration Time: When creating or modifying an Action target, the endpoint URL is now validated against a denylist. The functions command.Commands.AddTarget and command.Commands.ChangeTarget were updated to perform this check. Previously, they only checked if the URL was parsable, not if it pointed to a restricted address.
Execution Time: Right before making the HTTP request to the action's endpoint, another check against the denylist was added. This occurs in execution.CallTarget and actions.transport.RoundTrip. This serves as a defense-in-depth measure, preventing the SSRF even if a maliciously configured action somehow exists in the system.

Therefore, the vulnerable functions are those that either allowed the creation of the malicious configuration (AddTarget, ChangeTarget) or those that executed the request without proper checks (CallTarget, transport.RoundTrip). During an exploit, a profiler would likely show execution.CallTarget or actions.transport.RoundTrip in the stack trace as they are directly responsible for the outbound HTTP request that constitutes the SSRF.

Vulnerable functions

command.Commands.AddTarget

internal/command/action_v2_target.go

This function is used to create a new Action target. Before the patch, the `isValid` method only performed a basic URL parse and did not check if the endpoint was a local or internal IP address. This allowed an attacker to create an action that points to a sensitive internal endpoint.

command.Commands.ChangeTarget

internal/command/action_v2_target.go

Similar to AddTarget, this function is used to update an existing Action target. The vulnerability existed in the `isValid` method, which did not validate the updated endpoint against a denylist, allowing an attacker to change a legitimate action's endpoint to a malicious internal one.

execution.CallTarget

internal/execution/execution.go

This function is responsible for executing the configured action, which involves making an HTTP request to the target's endpoint. Before the patch, it did not perform any validation on the URL, making it the function that directly triggers the Server-Side Request Forgery (SSRF) when an action with a malicious endpoint is executed.

actions.transport.RoundTrip

internal/actions/http_module.go

This function acts as a custom HTTP transport for actions. The original implementation of the host blocking logic (`isHostBlocked`) was flawed or not configured by default to prevent requests to local addresses. This function would be in the stack trace when an SSRF is triggered through an action.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.