Vulnerability-Lookup

GHSA-FGMF-7RF8-M6VF

Vulnerability from github – Published: 2026-09-24 18:19 – Updated: 2026-09-24 18:19

Summary

ZITADEL: Actions V1 sandbox escape: host file read via require()

Details

Summary

A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript require() module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials (including the Login Client PAT) and escalate from a single-tenant organization owner to instance administrator.

Impact

ZITADEL Actions V1 run custom JavaScript inside the ZITADEL server process at OIDC, SAML, and login-flow trigger points. The runtime enables the goja Node-compatible require() registry without restricting the source loader, so Action scripts can load host files readable by the ZITADEL process (notably .js and .json, and in some cases other file contents via error channels).

An attacker with ORG_OWNER on any organization (which includes org.action.write and org.flow.write) can therefore:

Read process-readable host files, including configuration or secrets mounted into the API container (for example service-account material, projected secrets, or config carrying sensitive values).
On deployments that follow ZITADEL’s documented bootstrap paths (ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH, ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH), recover instance-wide credentials such as the IAM_LOGIN_CLIENT PAT or the IAM_OWNER service-account key, enabling escalation to full instance control.

This collapses the expected multi-tenant isolation boundary: a tenant organization administrator is not meant to access host filesystem secrets or instance-wide credentials.

Scope note: This issue affects Actions V1. Host command execution was not identified as part of this vulnerability. Impact depends on what the ZITADEL process can read on disk and on deployment layout — documented Compose and quick-start setups that write bootstrap PATs or machine keys into the API container amplify severity.

Affected Versions

Systems running one of the following versions are affected:

4.x: 4.0.0 through 4.16.0 (including RC versions)
3.x: 3.0.0 through 3.4.12 (including RC versions)

Patches

The vulnerability has been addressed in the latest releases. The patch disables filesystem-backed module loading for Action scripts so that only the intended native zitadel/* modules can be required.

4.x: Upgrade to $\ge$ 4.16.1
3.x: Upgrade to $\ge$ 3.4.13

Workarounds

If an immediate upgrade is not possible:

Restrict who can create, update, or attach Actions — do not grant org.action.write / org.flow.write (or ORG_OWNER) to untrusted administrators in multi-tenant environments.
Audit existing Actions for require() of filesystem paths.
Remove or relocate bootstrap credential files (login-client.pat, machine keys) so they are not readable inside the API process filesystem.
Limit host filesystem exposure for the ZITADEL process (no unnecessary readable secrets beside the binary).

Questions

If you have any questions or comments about this advisory, please email us at security@zitadel.com

Credits

Thanks to Dor Konis (@dkonis) and Feras Daragma (@FerasTr) from GE Vernova, and to pyuysig, for finding and reporting this vulnerability.

Severity

8.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/zitadel/zitadel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.80.0-v2.20.0.20260717062331-baf6ed501b68"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-85057"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-24T18:19:32Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript `require()` module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials (including the Login Client PAT) and escalate from a single-tenant organization owner to instance administrator.\n\n### Impact\n\nZITADEL Actions V1 run custom JavaScript inside the ZITADEL server process at OIDC, SAML, and login-flow trigger points. The runtime enables the goja Node-compatible `require()` registry without restricting the source loader, so Action scripts can load host files readable by the ZITADEL process (notably `.js` and `.json`, and in some cases other file contents via error channels).\n\nAn attacker with **ORG_OWNER** on any organization (which includes `org.action.write` and `org.flow.write`) can therefore:\n\n* Read process-readable host files, including configuration or secrets mounted into the API container (for example service-account material, projected secrets, or config carrying sensitive values).\n* On deployments that follow ZITADEL\u2019s documented bootstrap paths (`ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH`, `ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH`), recover instance-wide credentials such as the **IAM_LOGIN_CLIENT** PAT or the **IAM_OWNER** service-account key, enabling escalation to full instance control.\n\nThis collapses the expected multi-tenant isolation boundary: a tenant organization administrator is not meant to access host filesystem secrets or instance-wide credentials.\n\n**Scope note:** This issue affects **Actions V1**. Host command execution was not identified as part of this vulnerability. Impact depends on what the ZITADEL process can read on disk and on deployment layout \u2014 documented Compose and quick-start setups that write bootstrap PATs or machine keys into the API container amplify severity.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.16.0` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch disables filesystem-backed module loading for Action scripts so that only the intended native `zitadel/*` modules can be required.\n\n* **4.x**: Upgrade to $\\ge$ [4.16.1](https://github.com/zitadel/zitadel/releases/tag/v4.16.1)\n* **3.x**: Upgrade to $\\ge$ [3.4.13](https://github.com/zitadel/zitadel/releases/tag/v3.4.13)\n\n### Workarounds\n\nIf an immediate upgrade is not possible:\n\n* Restrict who can create, update, or attach Actions \u2014 do not grant `org.action.write` / `org.flow.write` (or **ORG_OWNER**) to untrusted administrators in multi-tenant environments.\n* Audit existing Actions for `require()` of filesystem paths.\n* Remove or relocate bootstrap credential files (`login-client.pat`, machine keys) so they are not readable inside the API process filesystem.\n* Limit host filesystem exposure for the ZITADEL process (no unnecessary readable secrets beside the binary).\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Dor Konis ([@dkonis](https://github.com/dkonis)) and Feras Daragma ([@FerasTr](https://github.com/FerasTr)) from GE Vernova, and to [pyuysig](https://github.com/pyuysig), for finding and reporting this vulnerability.",
  "id": "GHSA-fgmf-7rf8-m6vf",
  "modified": "2026-09-24T18:19:32Z",
  "published": "2026-09-24T18:19:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zitadel/zitadel"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.13"
    },
    {
      "type": "WEB",
      "url": "https://github.com/zitadel/zitadel/releases/tag/v4.16.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ZITADEL: Actions V1 sandbox escape: host file read via require()"
}

CVE-2026-85057 (GCVE-0-2026-85057)

Vulnerability from cvelistv5 – Published: 2026-09-24 17:31 – Updated: 2026-09-24 17:31

Title

ZITADEL: Actions V1 sandbox escape: host file read via require()

Summary

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

CWE

CWE-284 - Improper Access Control

Assigner

GitHub_M mitre root

References

6 references

URL	Tags
https://github.com/zitadel/zitadel/security/advis…	x_refsource_CONFIRM
https://github.com/zitadel/zitadel/commit/afe1086…	x_refsource_MISC
https://github.com/zitadel/zitadel/commit/baf6ed5…	x_refsource_MISC
https://github.com/zitadel/zitadel/commit/e28d6bc…	x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v3.4.13	x_refsource_MISC
https://github.com/zitadel/zitadel/releases/tag/v4.16.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
zitadel	zitadel	Affected: >= 3.0.0, < 3.4.13 Affected: >= 4.0.0, < 4.16.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "zitadel",
          "vendor": "zitadel",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 3.4.13"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.16.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-24T17:31:19.929Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e"
        },
        {
          "name": "https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v3.4.13",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v3.4.13"
        },
        {
          "name": "https://github.com/zitadel/zitadel/releases/tag/v4.16.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zitadel/zitadel/releases/tag/v4.16.1"
        }
      ],
      "source": {
        "advisory": "GHSA-fgmf-7rf8-m6vf",
        "discovery": "UNKNOWN"
      },
      "title": "ZITADEL: Actions V1 sandbox escape: host file read via require()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-85057",
    "datePublished": "2026-09-24T17:31:19.929Z",
    "dateReserved": "2026-09-02T21:21:01.774Z",
    "dateUpdated": "2026-09-24T17:31:19.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-FGMF-7RF8-M6VF

Summary

Impact

Affected Versions

Patches

Workarounds

Questions

Credits

CVE-2026-85057 (GCVE-0-2026-85057)

Tags

Sightings

Nomenclature

Related by attack behaviour