{"id":"CVE-2026-85057","kind":"vulnerability","aliases":["CVE-2026-85057","GHSA-fgmf-7rf8-m6vf","GO-2026-6591"],"related":[],"title":"ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel","description":"ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.","summary":"ZITADEL Actions V1 lets an organization Action author read arbitrary files that the ZITADEL server process can read through require(), because the filesystem loader is not restricted. An attacker with org owner-level action permissions can recover mounted secrets and bootstrap credentials, which can lead to instance administrator access.","severity":"high","cvss":8.7,"epss":0.0039,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/zitadel/zitadel","fixed":["1.80.0-v2.20.0.20260717062331-baf6ed501b68"],"affected":"< 1.80.0-v2.20.0.20260717062331-baf6ed501b68","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","identity","other","self-hosted","zitadel"],"not_affected_if":["actions-v1-unused","default-config","managed-hosting"],"how_to_check":"Check your ZITADEL version and whether Actions V1 is in use. Identify whether ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH are set.","fix":"Upgrade ZITADEL to 3.4.13 or 4.16.1 or later. Rotate any credentials that were stored through the bootstrap PAT or machine key paths if exposure is possible.","status":"open","published_at":"2026-09-24T18:19:04+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:37+00:00","updated_at":"2026-10-23T19:52:37+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T19:52:37Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ZITADEL to 3.4.13 or 4.16.1 or later. Rotate any credentials that were stored through the bootstrap PAT or machine key paths if exposure is possible.","summary":"ZITADEL Actions V1 lets an organization Action author read arbitrary files that the ZITADEL server process can read through require(), because the filesystem loader is not restricted. An attacker with org owner-level action permissions can recover mounted secrets and bootstrap credentials, which can lead to instance administrator access.","category":"other","who_cares":["zitadel","self-hosted","go","identity"],"confidence":0.8,"analyst_note":"Confirm the exact fixed ZITADEL version per release line and whether managed ZITADEL Cloud is patched; see GHSA-fgmf-7rf8-m6vf and GO-2026-6591.","how_to_check":"Check your ZITADEL version and whether Actions V1 is in use. Identify whether ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH are set.","needs_analyst":true,"not_affected_if":["managed-hosting","actions-v1-unused","default-config"],"severity_if_unknown":"high"},"cost_usd":0.000467,"input_tokens":2414,"output_tokens":452,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,24A,27A '-6591':25A '-85057':17A,28A '/zitadel/zitadel':14A,31A '3.0.0':98C '3.4.13':100C,203C '4.16.1':102C,205C '7rf8':21A 'access':88B 'action':2A,40B,45B,73B,104C,122C,188C 'administr':87B,180C,184C 'affect':187C 'arbitrari':48B 'attack':67B 'author':46B,123C 'bootstrap':80B,172C 'command':192C 'compat':111C 'configur':156C 'credenti':81B,160C,173C 'cve':15A,26A 'disclos':154C 'enabl':106C,175C 'escal':176C 'escap':5A 'establish':196C 'execut':193C 'fgmf':20A 'file':7A,49B,145C 'filesystem':61B,117C 'firstinst':164C,168C 'fix':200C 'flow':140C 'ghsa':19A 'ghsa-fgmf-7rf8-m6vf':18A 'github.com':13A,30A 'github.com/zitadel/zitadel':12A,29A 'go':23A,32B 'goja':108C 'host':6A,37B,191C 'ident':33B,94C 'includ':159C 'instanc':86B,183C 'issu':186C,198C 'javascript':133C 'lead':84B 'let':42B 'level':72B 'load':144C 'loader':62B,119C 'login':139C 'login-flow':138C 'loginclientpatpath':165C 'm6vf':22A 'machinekeypath':169C 'manag':95C 'mount':77B,155C 'node':110C 'node-compat':109C 'oidc':135C 'open':92C 'org':69B,125C 'org.action.write':127C 'org.flow.write':129C 'organ':44B,121C,179C 'owner':71B,126C 'owner-level':70B 'permiss':74B,130C 'platform':96C 'point':142C 'process':54B,151C 'read':8A,47B,56B 'readabl':146C 'recov':76B,171C 'registri':113C 'requir':10A,58B,112C 'restrict':65B,115C 'run':132C 'saml':136C 'sandbox':4A 'secret':78B,158C 'self':36B 'self-host':35B 'server':53B,150C 'sourc':93C,118C 'store':161C 'trigger':141C 'v1':3A,41B,105C,189C 'version':202C 'via':9A 'without':114C 'zitadel':1A,38B,39B,52B,89C,103C,149C,163C,167C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-24T18:19:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6591","url":"https://pkg.go.dev/vuln/GO-2026-6591","severity":null,"published_at":"2026-10-01T20:23:38+00:00","modified_at":"2026-10-01T20:23:38+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-85057","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85057","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-85057","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85057","severity":null,"published_at":"2026-09-24T18:19:04+00:00","modified_at":"2026-10-05T16:17:16+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}