CVE-2026-27945: ZITADEL Action V2 SSRF Vulnerability

CVE-2026-27945 Overview

ZITADEL, an open source identity management platform, contains a Server-Side Request Forgery (SSRF) vulnerability in its Action V2 feature. The Action V2 functionality, introduced as an early preview in version 2.59.0, beta in 3.0.0, and generally available in 4.0.0, uses a webhook-based approach that allows developers to act on API requests and customize flows such as token issuance. The vulnerability exists because Action target URLs can point to local hosts, potentially enabling adversaries to gather internal network information and connect to internal services.

Critical Impact

Authenticated attackers with high privileges can exploit this SSRF vulnerability to probe internal network infrastructure, enumerate internal services, and potentially access sensitive resources that should not be externally reachable.

Affected Products

• ZITADEL versions 2.59.0 through 4.11.0 (Action V2 feature)
• ZITADEL version 3.0.0 and later (beta Action V2)
• ZITADEL version 4.0.0 through 4.11.0 (GA Action V2)

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-27945 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-27945

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The core issue lies in the Action V2 feature's handling of target URLs for webhook callbacks. When configuring actions, users can specify URLs that the ZITADEL server will contact during various authentication and authorization flows. The platform fails to properly validate these URLs against internal or localhost addresses before making outbound requests.

The vulnerability requires network access and high privileges (administrative access to configure actions), which limits the attack surface. However, once exploited, an adversary can leverage the ZITADEL server as a proxy to make requests to internal network resources. This can lead to information disclosure about internal network topology, service discovery on private networks, and potential access to internal services that lack additional authentication when accessed from trusted internal sources.

ZITADEL Actions expect responses according to specific schemas, which provides some mitigation by limiting the data an attacker can exfiltrate through response parsing. However, the request itself still reaches the internal target, enabling network reconnaissance and potential exploitation of internal services vulnerable to unauthenticated access from trusted networks.

Root Cause

The root cause is the absence of URL validation against a denylist of internal addresses before the ZITADEL server initiates outbound HTTP requests to action target URLs. The Action V2 feature was designed to provide flexibility for webhook integrations but lacked security controls to prevent requests to localhost, loopback addresses (127.0.0.1, ::1), and potentially other private network ranges. This oversight allows privileged users to configure actions that target internal infrastructure rather than legitimate external webhook endpoints.

Attack Vector

The attack requires network access to the ZITADEL instance and high-privilege credentials capable of configuring actions. An attacker would:

1. Authenticate to ZITADEL with administrative privileges
2. Create or modify an Action V2 configuration
3. Set the target URL to point to an internal service (e.g., http://127.0.0.1:8080/admin, http://192.168.1.10/api/internal)
4. Trigger the action through normal authentication flows
5. Observe responses or error messages to enumerate internal services and gather network information

The vulnerability can be exploited to scan internal ports, access internal APIs, retrieve metadata from cloud provider metadata services, or interact with other internal services that trust requests from the ZITADEL server's network position.

Detection Methods for CVE-2026-27945

Indicators of Compromise

• Action configurations with target URLs pointing to localhost, 127.0.0.1, ::1, or private IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Unusual outbound network traffic from the ZITADEL server to internal infrastructure
• Action audit logs showing repeated failures or unusual response patterns when targeting internal addresses
• Configuration changes to actions by unexpected or compromised administrative accounts

Detection Strategies

• Monitor ZITADEL action configurations for target URLs containing localhost, loopback, or private network addresses
• Implement network monitoring to detect ZITADEL server connections to internal services that are not expected webhook destinations
• Review administrative audit logs for action creation or modification events, particularly those involving URL changes
• Deploy egress filtering rules and alert on violations from the ZITADEL application server

Monitoring Recommendations

• Enable comprehensive logging for all Action V2 configuration changes and executions
• Configure alerting for any action target URLs that resolve to internal IP addresses
• Implement network flow monitoring between the ZITADEL server and internal network segments
• Regularly audit action configurations as part of security review processes

How to Mitigate CVE-2026-27945

Immediate Actions Required

• Upgrade ZITADEL to version 4.11.1 or later, which includes a denylist check for target URLs
• Review all existing Action V2 configurations and remove or update any with suspicious target URLs
• Implement network-level controls to restrict outbound connections from the ZITADEL server
• Audit administrative access and ensure only trusted personnel can configure actions

Patch Information

The vulnerability is resolved in ZITADEL version 4.11.1, which implements target URL checking against a denylist. By default, localhost and loopback IP addresses are denied. This fix was only released for the v4.x branch. Due to the preview/beta stage of Action V2 in versions 2.x and 3.x, the significant changes since initial implementation, and the actual threat vector, a backport to earlier versions was not deemed feasible by the maintainers.

For detailed patch information, see the GitHub Security Advisory GHSA-7777 and the v4.11.0 release notes.

Workarounds

• If upgrading to version 4.11.1 is not possible, implement network policies or firewall rules to prevent the ZITADEL server from connecting to internal endpoints
• Configure egress filtering to allow connections only to known, legitimate webhook destinations
• Use network segmentation to isolate the ZITADEL server and limit potential SSRF impact
• Restrict administrative access to action configuration to minimize the risk of malicious configuration

# Example iptables rules to block ZITADEL outbound connections to private networks
# Apply these on the ZITADEL server host

# Block connections to localhost/loopback
iptables -A OUTPUT -p tcp -d 127.0.0.0/8 -m owner --uid-owner zitadel -j DROP

# Block connections to private network ranges
iptables -A OUTPUT -p tcp -d 10.0.0.0/8 -m owner --uid-owner zitadel -j DROP
iptables -A OUTPUT -p tcp -d 172.16.0.0/12 -m owner --uid-owner zitadel -j DROP
iptables -A OUTPUT -p tcp -d 192.168.0.0/16 -m owner --uid-owner zitadel -j DROP

# Block link-local addresses
iptables -A OUTPUT -p tcp -d 169.254.0.0/16 -m owner --uid-owner zitadel -j DROP