CVE-2026-85057

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.

• CWE-284

• https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7
• https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e
• https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d
• https://github.com/zitadel/zitadel/releases/tag/v3.4.13
• https://github.com/zitadel/zitadel/releases/tag/v4.16.1
• https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf

Published

Sep 24, 2026

Last Modified

Sep 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-85050Out of bounds write in WebGL in Google Chrome on on Android …9.6
• CVE-2026-85051Type confusion in Compositing in Google Chrome prior to 152.…8.8
• CVE-2026-85052Out of bounds read in CrashReporting in Google Chrome prior …3.1
• CVE-2026-85053Improper resource exposure in CacheStorage in Google Chrome …8.8
• CVE-2026-85055Twenty is an open-source CRM (customer relationship manageme…7.1
• CVE-2026-85056ZITADEL is an open source identity management platform. From…8.2
• CVE-2026-85058Moquette is a lightweight Java MQTT broker. Prior to 0.18.1,…7.5
• CVE-2026-85061MapLibre GL JS is an interactive vector tile map library for…10
• CVE-2026-85062Colord is a tiny yet powerful tool for high-performance colo…6.9
• CVE-2026-85063node-csv is a full-featured CSV parser with a simple API tha…6.9
• CVE-2026-8507Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have o…9.8
• CVE-2026-85077Sanic is an opensource python web server/framework. Prior to…8.2