ZITADEL heeft mogelijk SSRF via Actions in github.com/zitadel/zitadel

The SSRF vulnerability in Zitadel allows an attacker to craft malicious requests that originate from the Zitadel server itself. This means an attacker could potentially access internal resources that are not directly exposed to the internet, such as internal APIs, databases, or cloud services. The impact could range from information disclosure (e.g., reading configuration files or internal data) to potentially escalating privileges within the Zitadel environment. While the CVSS score is LOW, the potential for internal reconnaissance and lateral movement should not be underestimated, particularly in environments with complex internal network architectures. This vulnerability shares characteristics with other SSRF vulnerabilities where attackers leverage trusted internal access to probe and exploit other systems.

1. Gereserveerd2026-02-25
2. Gepubliceerd2026-03-10
3. Gewijzigd2026-04-15
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-27945 is to upgrade Zitadel to version 4.11.1 or later. If an immediate upgrade is not feasible, consider implementing temporary workarounds such as restricting outbound network access from the Zitadel server using a Web Application Firewall (WAF) or proxy. Configure the WAF to block requests to suspicious or unauthorized domains and IP addresses. Carefully review and restrict any allowed outbound URLs within Zitadel's configuration. After upgrading, verify the fix by attempting to trigger an SSRF request through Zitadel's Actions functionality and confirming that the request is blocked or redirected.