CVE-2026-27945: 
NixOS vulnerability analysis and mitigation

CVE-2026-27945 is a Server-Side Request Forgery (SSRF) vulnerability in ZITADEL's Action V2 webhook functionality, an open source identity management platform. The flaw allows adversaries with high privileges to configure action target URLs pointing to localhost or internal network hosts, potentially enabling internal network reconnaissance and interaction with internal services. Affected versions include ZITADEL 2.59.0–2.71.19 (2.x), 3.0.0–3.4.6 (3.x), and 4.0.0–4.11.0 (4.x). The vulnerability was disclosed on February 25, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) by NVD and a CVSS v4.0 base score of 2.1 (Low) by the CNA (GitHub Advisory, NVD).

The root cause is classified as CWE-918 (Server-Side Request Forgery), arising from the absence of URL validation in ZITADEL's Action V2 webhook system. Action V2, introduced as an early preview in v2.59.0, beta in v3.0.0, and GA in v4.0.0, allows developers to configure webhook target URLs that ZITADEL calls during API request flows (e.g., token issuance). Without URL validation, a privileged attacker can set a target URL to localhost, 127.0.0.1, or other loopback/internal addresses, causing the ZITADEL server to make outbound HTTP requests to those internal endpoints. The threat vector is partially mitigated by ZITADEL's requirement that webhook responses conform to specific schemas, limiting the attacker's ability to fully interact with arbitrary internal services (GitHub Advisory). The patch (commit b2532e9) introduces a configurable DenyList in the Executions configuration block, defaulting to blocking localhost, 127.0.0.0/8, ::1, 0.0.0.0, and :: (Patch Commit).

Successful exploitation allows a privileged attacker to perform internal network reconnaissance by directing ZITADEL's server-side HTTP requests to internal hosts, potentially revealing the structure of internal networks and the services running on them. The primary risks are limited confidentiality and integrity impacts — an attacker may discover internal service endpoints and, in some cases, interact with them if their responses happen to match ZITADEL's expected action schemas. Availability is not impacted. The vulnerability does not directly enable remote code execution or full system compromise, but could facilitate lateral movement by exposing internal service details (GitHub Advisory, NVD).

No public proof-of-concept exploit code is known, and there is no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability requires high privileges to exploit (the attacker must be able to configure ZITADEL Actions), which significantly limits the attack surface. The EPSS score is approximately 0.034% (0.000340), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered by zentrust partners GmbH during a scheduled penetration test (GitHub Advisory).

1. Gain privileged access: Obtain high-privilege credentials within a ZITADEL instance (e.g., an organization or instance administrator account) that allow configuration of Action V2 targets.
2. Navigate to Action V2 configuration: Access the ZITADEL admin console or API to create or modify an Action V2 execution target.
3. Set a malicious target URL: Configure the action's webhook target URL to point to an internal address, such as http://localhost:8080/, http://127.0.0.1/, or an internal network host (e.g., http://192.168.1.1/).
4. Trigger the action: Initiate an API flow that invokes the configured action (e.g., a token issuance request), causing ZITADEL's server to make an outbound HTTP request to the specified internal URL.
5. Analyze responses: Observe any error messages, timing differences, or partial response data returned through ZITADEL's action execution pipeline to infer information about internal services and network topology (GitHub Advisory).

• Logs: ZITADEL audit logs showing creation or modification of Action V2 targets with URLs pointing to localhost, 127.x.x.x, ::1, 0.0.0.0, or RFC-1918 private IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x).
• Network: Unexpected outbound HTTP requests from the ZITADEL server process to loopback or internal network addresses, particularly on non-standard ports.
• Configuration: Presence of action target URLs in ZITADEL's database or configuration referencing internal hostnames or IP addresses rather than external, publicly routable endpoints.

The primary fix is to upgrade ZITADEL to version 4.11.1 or later, which introduces a configurable URL denylist blocking localhost, 127.0.0.0/8, ::1, 0.0.0.0, and :: by default for action target URLs (GitHub Advisory, Patch Commit). No patch is available for v2.x or v3.x branches due to the preview/beta status of the feature in those versions. For organizations unable to upgrade, the recommended workaround is to implement network-level policies or firewall rules that restrict outbound HTTP connections from the ZITADEL server to internal/loopback addresses. Additionally, administrators should audit existing Action V2 configurations to ensure no targets point to internal endpoints, and restrict Action V2 configuration permissions to trusted users only.

The vulnerability was discovered by zentrust partners GmbH (analysts Martin Tschirsich, Joud Zakharia, and Christopher Baumann) during a scheduled penetration test, with the full report to be made public after complete review (GitHub Advisory). Red Hat tracked the CVE in their security database, and the ENISA European Vulnerability Database (EUVD) catalogued it as EUVD-2026-8793. General community reaction has been limited given the low severity and privilege requirements of the vulnerability.