CVE-2026-105214 Overview
CVE-2026-105214 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Zitadel versions before 4.16.2. The flaw resides in the organization domain HTTP verification feature, where the challenge fetch uses Go's default http.Get function instead of the hardened HTTP client. An authenticated attacker can register a domain that redirects to loopback addresses, internal IP ranges, or cloud metadata endpoints. This enables port scanning, internal network mapping, and potential exposure of sensitive metadata. The vulnerability was disclosed through a GitHub Security Advisory and tracked by VulnCheck.
Critical Impact
Authenticated attackers can abuse Zitadel's domain verification to probe internal infrastructure and reach cloud metadata services via server-initiated HTTP requests.
Affected Products
- Zitadel identity and access management server
- All Zitadel releases prior to version 4.16.2
- Deployments exposing organization domain verification to tenant users
Discovery Timeline
- 2026-10-04 - CVE-2026-105214 published to NVD
- 2026-10-05 - Last updated in NVD database
Technical Details for CVE-2026-105214
Vulnerability Analysis
Zitadel allows organizations to prove domain ownership by hosting an HTTP challenge token on the claimed domain. The server fetches the challenge URL and compares the response to the expected value. The fetch is performed with Go's default http.Get, which lacks safeguards against requests to private networks or redirect-based pivoting.
An attacker registers a domain they control and configures the challenge endpoint to issue an HTTP redirect. The redirect target can be 127.0.0.1, RFC1918 ranges such as 10.0.0.0/8, or cloud metadata endpoints like 169.254.169.254. Zitadel follows the redirect and returns timing or response signals that reveal whether the internal host and port are reachable.
Successful exploitation enables port scanning of internal services, mapping of adjacent infrastructure, and in some deployments, retrieval of cloud instance metadata containing temporary credentials.
Root Cause
The root cause is the use of http.Get from Go's standard library in the domain challenge fetch path. Zitadel maintains a protected HTTP client that blocks requests to loopback, link-local, and private IP ranges, but this client was not applied to the verification routine. Redirect handling in http.Get follows up to ten redirects by default without validating the target address against an allowlist.
Attack Vector
Exploitation requires an authenticated user with permission to add and verify an organization domain. The attacker points the domain's challenge path to a server that returns an HTTP 3xx redirect to an internal address. Zitadel's backend performs the follow-up request from within its trust boundary, producing observable responses that leak internal topology. See the GitHub Security Advisory GHSA-93hm-8q29-c8cr and the VulnCheck Zitadel SSRF Advisory for additional detail.
Detection Methods for CVE-2026-105214
Indicators of Compromise
- Outbound HTTP requests from Zitadel server processes to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254.
- Domain verification attempts targeting attacker-controlled domains that respond with 3xx redirects.
- Audit log entries showing repeated failed domain verifications tied to a single tenant or user.
Detection Strategies
- Inspect egress proxy and firewall logs for Zitadel-originated requests resolving to internal CIDR ranges.
- Correlate Zitadel domain-add events with outbound DNS and HTTP traffic patterns inconsistent with public internet destinations.
- Alert on redirect chains where the final hop is a private or link-local address.
Monitoring Recommendations
- Enable verbose logging on the domain verification endpoint and ship events to a centralized SIEM.
- Monitor requests to cloud metadata endpoints from any application tier, not just Zitadel.
- Track the rate of domain verification attempts per account and flag abnormal spikes.
How to Mitigate CVE-2026-105214
Immediate Actions Required
- Upgrade Zitadel to version 4.16.2 or later across all environments.
- Audit recent domain verification activity for redirects to internal address space.
- Rotate any cloud instance credentials that may have been exposed via the metadata service.
Patch Information
Zitadel released version 4.16.2 to fix the SSRF by routing domain verification requests through the protected HTTP client. The protected client blocks resolution to loopback, link-local, and private ranges and validates each hop in a redirect chain. Review the GitHub Security Advisory GHSA-93hm-8q29-c8cr for upgrade instructions.
Workarounds
- Place Zitadel behind an egress proxy that denies outbound connections to private and link-local ranges.
- Enforce Instance Metadata Service v2 (IMDSv2) with hop-limit of 1 on AWS to block metadata abuse.
- Restrict which users can add or verify organization domains until the patch is deployed.
# Example egress restriction using iptables to block Zitadel access to metadata and internal ranges
iptables -A OUTPUT -m owner --uid-owner zitadel -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zitadel -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zitadel -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zitadel -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
