CVE-2026-105214

2.3 Faible

Publiée le 04/10/2026 à 17:16 · Modifiée le 05/10/2026 à 23:16 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register domains that redirect to loopback, internal, or cloud metadata addresses to scan ports and map internal networks.

Traduire en français

Produits concernés

zitadel

Scores CVSS

Version	Score	Source	Vecteur
4.0	2.3 Faible	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-918

Références

https://github.com/zitadel/zitadel/security/advisories/GHSA-93hm-8q29-c8cr
https://www.vulncheck.com/advisories/zitadel-before-4.16.2-ssrf-via-organization-domain-http-verification

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories