Vulnerability · Published Oct 4, 2026 · Assigned by VulnCheck

CVE-2026-105214Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification

Low 2.3

In plain English

A low-severity server-side request forgery in zitadel from zitadel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 4.0)2.3Low

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resources through organization domain HTTP verification. The challenge fetch uses Go's default http.Get instead of the protected client, so attackers can register domains that redirect to loopback, internal, or cloud metadata addresses to scan ports and map internal networks.

Affected products (as reported)

Vendor	Product	Versions
zitadel	zitadel	0 – before 4.16.2

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-93hm-8q29-c8cr) vendor-advisory
VulnCheck Advisory: Zitadel before 4.16.2 SSRF via Organization Domain HTTP Verification third-party-advisory