CVE-2026-58165: OpenZiti Privilege Escalation Vulnerability

CVE-2026-58165 Overview

CVE-2026-58165 is a privilege escalation vulnerability in OpenZiti through version 2.0.0. The flaw exists in the ApplyCreate function within controller/model/enrollment_manager.go, which verifies that a target identity exists but omits authorization checks binding the caller to that identity. Authenticated non-admin users holding fine-grained enrollment management permissions can create enrollments for any identity, including the default administrator. The issue is fixed in commit 3027fdf.

Critical Impact
Attackers can redeem a fraudulently created one-time enrollment token through the unauthenticated client API to obtain a certificate authenticating as an admin, yielding full control of the controller and the zero-trust overlay it manages.

Affected Products

OpenZiti versions up to and including 2.0.0
OpenZiti controller component (controller/model/enrollment_manager.go)
Zero-trust overlay networks managed by affected OpenZiti controllers

Discovery Timeline

2026-06-30 - CVE-2026-58165 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58165

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-862] in OpenZiti's enrollment management API. OpenZiti is an open-source zero-trust networking platform, and its controller mediates identity issuance for the overlay. The ApplyCreate function in controller/model/enrollment_manager.go accepts an enrollment creation request from any caller that holds fine-grained enrollment management permissions. It confirms the target identity exists but never validates that the caller is authorized to act on that identity.

As a result, a low-privileged authenticated user can create a new enrollment record targeting the default administrator identity. The controller returns a valid one-time enrollment token (JWT) tied to that admin identity. The attacker then submits the token to the unauthenticated client API enrollment endpoint, which issues a client certificate for the admin. That certificate authenticates the attacker as the administrator on subsequent controller API calls.

Root Cause

The root cause is the absence of an authorization predicate that binds the calling identity to the target identity during enrollment creation. Existence checks are treated as sufficient, but they do not enforce the caller's scope of control. The fix in commit 3027fdf introduces authorization logic in controller/internal/routes/enrollment_router.go to prevent enrollment creation against admin identities by non-admin callers.

Attack Vector

The attack is network-reachable and requires low privileges (any authenticated identity with enrollment management rights). No user interaction is required. Because the redemption step uses the unauthenticated client API, the attacker can complete the chain without additional credentials once the token is generated.

 package routes
 
 import (
+	"errors"
 	"time"
 
 	"github.com/go-openapi/runtime/middleware"
 	"github.com/openziti/edge-api/rest_management_api_server/operations/enrollment"
 	"github.com/openziti/edge-api/rest_model"
 	"github.com/openziti/foundation/v2/errorz"
+	"github.com/openziti/foundation/v2/stringz"
 	"github.com/openziti/ziti/v2/controller/env"
 	"github.com/openziti/ziti/v2/controller/model"
+	"github.com/openziti/ziti/v2/controller/models"
 	"github.com/openziti/ziti/v2/controller/permissions"
 	"github.com/openziti/ziti/v2/controller/response"
+	"github.com/openziti/ziti/v2/controller/storage/ast"
 )

Source: GitHub Commit 3027fdf. The patch adds imports supporting authorization and identity binding checks in the enrollment router.

Detection Methods for CVE-2026-58165

Indicators of Compromise

Enrollment records created against the default administrator identity or other admin identities by non-admin callers.
Client certificates issued through the client API enrollment endpoint for admin identities shortly after an enrollment token was created by a non-admin identity.
Unexpected admin API activity originating from newly enrolled client certificates or unfamiliar source addresses.

Detection Strategies

Correlate controller audit events: match enrollment creation requests (management API) with subsequent enrollment redemption events (client API) targeting the same identity.
Alert when the caller identity of an enrollment creation differs from the target identity and the target holds an admin role.
Baseline normal enrollment volume per operator identity and flag deviations, especially any enrollment referencing admin roles.

Monitoring Recommendations

Enable and forward OpenZiti controller audit logs to a centralized log store for retention and analysis.
Monitor the /edge/management/v1/enrollments and /edge/client/v1/enroll endpoints for anomalous request patterns.
Review identity role assignments periodically and alert on any account granted enrollment management permissions.

How to Mitigate CVE-2026-58165

Immediate Actions Required

Upgrade OpenZiti to a build that includes commit 3027fdf or a later release beyond 2.0.0.
Audit all identities holding fine-grained enrollment management permissions and revoke privileges that are not strictly required.
Rotate the default administrator credentials and any certificates issued during the exposure window.
Review enrollment history for tokens created against admin identities and invalidate any suspicious enrollments.

Patch Information

The fix is delivered in commit 3027fdf of the openziti/ziti repository. See the GitHub Commit Notification, the GitHub Issue Report #4010, the GitHub Pull Request #4013, and the VulnCheck Privilege Escalation Advisory.

Workarounds

Remove enrollment management permissions from all non-admin identities until patched.
Restrict network access to the controller management API to trusted administrative networks only.
Enforce short enrollment token lifetimes and monitor the client enrollment endpoint for redemption attempts.

bash

# Verify running OpenZiti controller version and patch commit
ziti version
git -C /path/to/ziti log --oneline | grep 3027fdf

# Example: list identities with enrollment management permissions for review
ziti edge list identities 'roleAttributes contains "enrollment-admin"'