2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-55671

CVE-2026-55671: ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to loopback, internal IP, link-local, or redirected endpoints through DNS rebinding, redirects, or protocol downgrades. This issue is fixed in version 4.15.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-55671

CVE-2026-55671:

2.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/zitadel/zitadel	go	< 1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2	1.80.0-v2.20.0.20260615133614-8e82ec1cb9a2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) caused by insufficient validation of user-provided URLs in several components of ZITADEL. The application made outgoing HTTP requests to URLs supplied for HTTP notification webhooks, OIDC back-channel logouts, and SAML metadata fetching. The existing denylist mechanism was found to be inadequate and could be bypassed using techniques like DNS rebinding, HTTP redirects, and protocol downgrades (HTTPS to HTTP).

The patch addresses this vulnerability by introducing a new, centralized, and hardened HTTP client. This client is configured with a comprehensive denylist of local and private network ranges, and it is designed to prevent common bypass techniques. Specifically, it disallows HTTPS-to-HTTP redirects, limits the number of redirects, and performs DNS resolution checks against the denylist to counter DNS rebinding attacks.

The fix involved a significant refactoring to replace all instances of direct HTTP requests in the vulnerable components with calls through this new secure client. The identified vulnerable functions are the primary entry points in the code that initiated these unsafe outbound requests based on user input. By analyzing the patch, we can see the old denylist parameters being removed and the new httpClient being passed into all affected functions, thereby ensuring all outgoing traffic is subject to the new, stricter security controls.

Vulnerable functions

execution.CallTargets

internal/execution/execution.go

This function is responsible for executing 'Actions', which can involve making HTTP requests to external webhooks defined by users. Prior to the patch, the HTTP client used for these requests had an inadequate denylist mechanism that was susceptible to bypasses (e.g., DNS rebinding, redirects). This allowed an attacker to configure an Action that targets internal network services, leading to SSRF. The patch replaces the vulnerable client with a new, hardened HTTP client that enforces a stricter security policy.

saml.(*Storage).GetEntityByID

internal/api/saml/storage.go

This function is used to retrieve SAML service provider metadata, which can be fetched from a URL. Before the patch, this operation used a default HTTP client with no SSRF protection, allowing an attacker to specify a URL pointing to an internal service. The patch ensures that all metadata fetching is performed through the new, secure HTTP client, which validates the target URL against a hardened denylist.

command.(*Commands).FetchSAMLMetadata

internal/command/idp_template.go

This function fetches SAML metadata from a user-provided URL. It was vulnerable to SSRF because it did not properly validate the supplied URL before making an HTTP request. An attacker could abuse this to scan the internal network or interact with internal services. The fix involves routing these requests through the newly introduced hardened HTTP client.

webhook.(*WebhookConfig).Notify

internal/notification/channels/webhook/channel.go

This function sends notifications to user-configured webhook URLs. The vulnerability existed because the URLs were not validated against a sufficiently robust denylist, allowing an attacker to set the webhook to an internal IP address or a sensitive cloud metadata endpoint. The patch ensures that all webhook notifications are sent using the secure HTTP client, preventing SSRF.

oidc.(*Server).backChannelLogout

internal/api/oidc/session.go

This unexported function handles the OIDC back-channel logout process, which requires the ZITADEL server to make an HTTP request to a client's logout URI. Since this URI is configurable, an attacker could provide a malicious URL pointing to an internal service. The vulnerability was that this request was not properly sanitized. The patch ensures that the back-channel logout request is made through the hardened HTTP client, mitigating the SSRF risk.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.