# CVE-2026-27945: zitadel SSRF — Fixed in 4.11.1 🐹 Go Not in CISA KEV # CVE-2026-27945 — zitadel [Fix: zitadel/zitadel@b2532e9](https://github.com/zitadel/zitadel/commit/b2532e9666215bef04855d138ca716045bb74a06) CVE-2026-27945 is a Server-Side Request Forgery (SSRF) vulnerability in github.com/zitadel/zitadel/v2. A fix is available for github.com/zitadel/zitadel/v2 — see the affected versions and patch details below. ZITADEL has potential SSRF via Actions Also known as[GHSA-7777-fhq9-592v](/vulnerability/GHSA-7777-fhq9-592v)GO-2026-4574 Published Feb 26, 2026 Updated Oct 28, 2026 Affected 2 pkgs Patched 2 / 2 Exploits None indexed Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-27945. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs17th percentile — riskier than 17% of all scored CVEsHighest risk Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 2 pkgs affected 🐹`github.com/zitadel/zitadel/v2`🐹`github.com/zitadel/zitadel/v2` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary ZITADEL Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. ZITADEL's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. #### Impact When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a Server-Side Request Forgery (SSRF). ZITADEL Actions expect responses according to specific schemas, which reduces the threat vector. #### Affected Versions Systems running one of the following versions are affected: - **4.x**: `4.0.0` through `4.11.0` (including RC version) - **3.x**: `3.0.0` to `3.4.6` (including RC versions) - **2.x**: `2.59.0` to `2.71.19` #### Patches The vulnerability has been addressed in the latest releases. The patch resolves the issue by checking the target URL against a denylist. By default localhost, resp. loopback IPs are denied. Note that this fix was only released on v4.x. Due to the stage (preview / beta) in which the functionality was in v2.x and v3.x, the changes that have been applied to it since then and the severity, respectively the actual thread vector, a backport to the corresponding versions was not feasible. Please check the workaround section for alternative solutions if an upgrade to v4.x is not possible. 4.x: Upgrade to >=[4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1) 3.x: Update to >=[v4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1) or check out workarounds 2.x: Update to >=[v4.11.1](https://github.com/zitadel/zitadel/releases/tag/v4.11.1) or check out workarounds #### Workarounds The recommended solution is to update Zitadel to a patched version. If an upgrade is not possible, users can prevent actions from using unintended endpoints by setting network policies or firewall rules in your infrastructure. Note that this is outside of the functionality provided by ZITADEL. #### Questions If there are any questions or comments about this advisory, please send an email to [security@zitadel.com](mailto:security@zitadel.com) #### Credits This vulnerability was found by [zentrust partners GmbH](https://zentrust.partners) during a scheduled penetration test. Thank you to the analysts Martin Tschirsich, Joud Zakharia, Christopher Baumann. The full report will be made public after the complete review. ## Affected Packages 2 total 2 fixed Ecosystem Package Vulnerable range Fix 🐹Go `github.com/zitadel/zitadel/v2` ≥ 2.59.0&&< 4.11.1 4.11.1`go get github.com/zitadel/zitadel/v2@v4.11.1` 🐹Go `github.com/zitadel/zitadel/v2` all versions 1.80.0-v2.20.0.20260225053328-b2532e966621`go get github.com/zitadel/zitadel/v2@v1.80.0-v2.20.0.20260225053328-b2532e966621` ## Affected Products 1 product · 2 configurations Application `zitadel`zitadel ≥ 4.0.0 && ≤ 3.4.6 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/zitadel/zitadel/v2, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update github.com/zitadel/zitadel/v2 to 4.11.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-27945 is resolved across your whole dependency graph. 3. ### Workarounds Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated. ## Frequently Asked Questions \### Summary ZITADEL Action V2 (introduced as early preview in 2.59.0, beta in 3.0.0 and GA in 4.0.0) is a webhook based approach to allow developers act on API request to Zitadel and customize flows such the issue of a token. ZITADEL's Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. ### Impact When the URL points to a local host / IP address, an adversary might gather information about the internal network structure, the services exposed on internal hosts etc. This is sometimes called a S O3 Security · Impact-Aware SCA ### Is CVE-2026-27945 in your dependencies? Find it across Go, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)