{"schema":"threatline.record/2","record":{"id":"CVE-2026-85057","aliases":["GHSA-fgmf-7rf8-m6vf","GO-2026-6591"],"summary":"ZITADEL: Actions V1 sandbox escape: host file read via require()","details":"### Summary\n\nA vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript `require()` module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials (including the Login Client PAT) and escalate from a single-tenant organization owner to instance administrator.\n\n### Impact\n\nZITADEL Actions V1 run custom JavaScript inside the ZITADEL server process at OIDC, SAML, and login-flow trigger points. The runtime enables the goja Node-compatible `require()` registry without restricting the source loader, so Action scripts can load host files readable by the ZITADEL process (notably `.js` and `.json`, and in some cases other file contents via error channels).\n\nAn attacker with **ORG_OWNER** on any organization (which includes `org.action.write` and `org.flow.write`) can therefore:\n\n* Read process-readable host files, including configuration or secrets mounted into the API container (for example service-account material, projected secrets, or config carrying sensitive values).\n* On deployments that follow ZITADEL’s documented bootstrap paths (`ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH`, `ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH`), recover instance-wide credentials such as the **IAM_LOGIN_CLIENT** PAT or the **IAM_OWNER** service-account key, enabling escalation to full instance control.\n\nThis collapses the expected multi-tenant isolation boundary: a tenant organization administrator is not meant to access host filesystem secrets or instance-wide credentials.\n\n**Scope note:** This issue affects **Actions V1**. Host command execution was not identified as part of this vulnerability. Impact depends on what the ZITADEL process can read on disk and on deployment layout — documented Compose and quick-start setups that write bootstrap PATs or machine keys into the API container amplify severity.\n\n### Affected Versions\n\nSystems running one of the following versions are affected:\n\n* **4.x:** `4.0.0` through `4.16.0` (including RC versions)\n* **3.x:** `3.0.0` through `3.4.12` (including RC versions)\n\n### Patches\n\nThe vulnerability has been addressed in the latest releases. The patch disables filesystem-backed module loading for Action scripts so that only the intended native `zitadel/*` modules can be required.\n\n* **4.x**: Upgrade to $\\ge$ [4.16.1](https://github.com/zitadel/zitadel/releases/tag/v4.16.1)\n* **3.x**: Upgrade to $\\ge$ [3.4.13](https://github.com/zitadel/zitadel/releases/tag/v3.4.13)\n\n### Workarounds\n\nIf an immediate upgrade is not possible:\n\n* Restrict who can create, update, or attach Actions — do not grant `org.action.write` / `org.flow.write` (or **ORG_OWNER**) to untrusted administrators in multi-tenant environments.\n* Audit existing Actions for `require()` of filesystem paths.\n* Remove or relocate bootstrap credential files (`login-client.pat`, machine keys) so they are not readable inside the API process filesystem.\n* Limit host filesystem exposure for the ZITADEL process (no unnecessary readable secrets beside the binary).\n\n### Questions\n\nIf you have any questions or comments about this advisory, please email us at [security@zitadel.com](mailto:security@zitadel.com)\n\n### Credits\n\nThanks to Dor Konis ([@dkonis](https://github.com/dkonis)) and Feras Daragma ([@FerasTr](https://github.com/FerasTr)) from GE Vernova, and to [pyuysig](https://github.com/pyuysig), for finding and reporting this vulnerability.","categories":["Libraries & packages"],"product":"github.com/zitadel/zitadel","vendor":"zitadel","ecosystem":"go","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fgmf-7rf8-m6vf","source_modified_at":"2026-09-24T18:19:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/zitadel/zitadel"},"range":"< 1.80.0-v2.20.0.20260717062331-baf6ed501b68"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-85057","source_modified_at":"2026-10-05T15:32:54.542Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"zitadel","vendor":"zitadel","versions":[{"version":">= 3.0.0, < 3.4.13","status":"affected"},{"version":">= 4.0.0, < 4.16.1","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf","source_modified_at":"2026-10-01T20:56:14.597424590Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.80.0-v2.20.0.20260717062331-baf6ed501b68"}],"type":"SEMVER"}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-fgmf-7rf8-m6vf","source_modified_at":"2026-09-24T18:19:34Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"go","name":"github.com/zitadel/zitadel"},"version":"1.80.0-v2.20.0.20260717062331-baf6ed501b68"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf","source_modified_at":"2026-10-01T20:56:14.597424590Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Go","name":"github.com/zitadel/zitadel","purl":"pkg:golang/github.com/zitadel/zitadel"},"version":"1.80.0-v2.20.0.20260717062331-baf6ed501b68"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0039,"percentile":0.31965,"score_date":"2026-10-23"},"published_at":"2026-09-24T17:31:19.929Z","modified_at":"2026-10-05T15:32:54.542Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-fgmf-7rf8-m6vf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-24T18:19:34Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-85057","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-05T15:32:54.542Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-fgmf-7rf8-m6vf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T20:56:14.597424590Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85057","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zitadel/zitadel/releases/tag/v3.4.13","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/zitadel/zitadel/releases/tag/v4.16.1","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-fgmf-7rf8-m6vf","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-05T14:53:03.930118Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-05T15:32:54.542Z","content_hash":"cfb53e97cde9242540792cfee569a904223e03b2b76798617f10f22effd7eb93"}}