CVE-2026-55671 Overview
CVE-2026-55671 is a Server-Side Request Forgery (SSRF) vulnerability in ZITADEL, an open source identity management platform. Affected versions from 4.0.0-rc.1 through 4.15.1 fail to consistently validate user-defined URLs across HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches. Authenticated users can coerce the server into issuing outbound requests to loopback addresses, internal IP ranges, link-local endpoints, or redirected destinations by abusing DNS rebinding, HTTP redirects, or protocol downgrades. The issue is tracked as [CWE-918] and is fixed in version 4.15.2.
Critical Impact
Authenticated attackers can pivot ZITADEL into internal network reconnaissance and access to metadata services normally unreachable from the internet.
Affected Products
- ZITADEL versions 4.0.0-rc.1 through 4.15.1
- ZITADEL HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetch components
- Any deployment exposing ZITADEL configuration endpoints to low-privileged tenant administrators
Discovery Timeline
- 2026-07-10 - CVE-2026-55671 published to NVD
- 2026-07-14 - Last updated in NVD database
- Fixed version - ZITADEL v4.15.2 released with protected HTTP client enforcement
Technical Details for CVE-2026-55671
Vulnerability Analysis
ZITADEL supports outbound HTTP requests for several integration features. Notification channels post webhook payloads, OIDC BackChannel Logout notifies relying parties, and SAML integrations fetch metadata from configured URLs. In vulnerable releases these code paths use HTTP clients that do not consistently enforce ZITADEL's denylist of protected destinations. An authenticated user with permission to configure these integrations can supply URLs that resolve to internal addresses. The server then issues the request on the attacker's behalf, potentially reaching cloud instance metadata endpoints, internal admin panels, or service mesh APIs.
Root Cause
The root cause is inconsistent URL validation across outbound HTTP call sites. Several packages instantiated the standard library net/http client directly rather than the hardened client that enforces destination filtering. Even where filtering existed, DNS rebinding, 30x redirects, and protocol downgrades from https to http allowed bypass of initial checks.
Attack Vector
An authenticated user configures a notification channel, OIDC logout URI, or SAML metadata URL pointing to a controlled host. That host responds with a redirect or returns a rebound DNS answer that resolves to 127.0.0.1, 169.254.169.254, or an RFC 1918 address. ZITADEL follows the request and returns or acts on the internal response, enabling SSRF-based enumeration and data exposure.
// Security patch: cmd/mirror/projections.go and cmd/setup/03.go
// Removes direct use of net/http in favor of a protected HTTP client
"database/sql"
"errors"
"fmt"
- "net/http"
"sync"
"time"
// Source: https://github.com/zitadel/zitadel/commit/b6f78086913b8d916bce9ab2e049ab0d84f947fd
Detection Methods for CVE-2026-55671
Indicators of Compromise
- Outbound HTTP connections from the ZITADEL process to loopback (127.0.0.0/8), link-local (169.254.0.0/16), or RFC 1918 ranges
- Notification, OIDC, or SAML configuration entries whose URLs resolve to internal or metadata service hostnames
- HTTP 3xx redirect chains in ZITADEL egress logs that terminate at internal addresses
Detection Strategies
- Audit ZITADEL configuration for notification endpoints, back_channel_logout_uri values, and SAML metadata URLs referencing suspicious or short-TTL DNS names
- Compare DNS resolution results for configured URLs against known-internal CIDR ranges at the time of each outbound request
- Alert on ZITADEL egress traffic that violates the network segmentation policy for the identity platform
Monitoring Recommendations
- Forward ZITADEL application logs and egress netflow to a centralized analytics platform for correlation
- Enable DNS query logging on the ZITADEL host to identify rebinding patterns where the same hostname returns both public and private A records
- Track configuration changes to notification, OIDC, and SAML integrations, especially by non-administrative tenants
How to Mitigate CVE-2026-55671
Immediate Actions Required
- Upgrade ZITADEL to version 4.15.2 or later, which routes all affected outbound requests through the protected HTTP client
- Review existing notification, OIDC BackChannel Logout, and SAML metadata URLs and remove any pointing to unexpected destinations
- Restrict who can configure integration URLs to trusted administrators only
Patch Information
The fix is delivered in ZITADEL v4.15.2. The commit replaces direct net/http client usage with the platform's protected client across affected call sites. Details are available in the ZITADEL security advisory GHSA-29jh-8cfq-rr8x, the GitHub commit, and the v4.15.2 release notes.
Workarounds
- Place ZITADEL behind an egress proxy that denies traffic to loopback, link-local, and RFC 1918 destinations until the upgrade is applied
- Block access to the cloud instance metadata service (169.254.169.254) from the ZITADEL workload using host firewall or IMDSv2 enforcement
- Disable or restrict OIDC BackChannel Logout and SAML metadata URL features where they are not required
# Example iptables egress restriction for the ZITADEL host
iptables -A OUTPUT -m owner --uid-owner zitadel -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zitadel -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zitadel -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zitadel -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner zitadel -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
