---
id: "CVE-2026-85057"
kind: "vulnerability"
aliases: ["CVE-2026-85057", "GHSA-fgmf-7rf8-m6vf", "GO-2026-6591"]
title: "ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel"
severity: "high"
cvss: 8.7
epss: 0.0039
exploited: false
status: "open"
category: "other"
products: [{"name": "github.com/zitadel/zitadel", "fixed": ["1.80.0-v2.20.0.20260717062331-baf6ed501b68"], "affected": "< 1.80.0-v2.20.0.20260717062331-baf6ed501b68", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["go", "identity", "other", "self-hosted", "zitadel"]
not_affected_if: ["actions-v1-unused", "default-config", "managed-hosting"]
published_at: "2026-09-24T18:19:04+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T19:52:37+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6591", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-85057", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85057", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel

ZITADEL Actions V1 lets an organization Action author read arbitrary files that the ZITADEL server process can read through require(), because the filesystem loader is not restricted. An attacker with org owner-level action permissions can recover mounted secrets and bootstrap credentials, which can lead to instance administrator access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/zitadel/zitadel affected < 1.80.0-v2.20.0.20260717062331-baf6ed501b68 fixed 1.80.0-v2.20.0.20260717062331-baf6ed501b68

## How to check

Check your ZITADEL version and whether Actions V1 is in use. Identify whether ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH are set.

## Fix

Upgrade ZITADEL to 3.4.13 or 4.16.1 or later. Rotate any credentials that were stored through the bootstrap PAT or machine key paths if exposure is possible.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6591
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-85057
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-85057

## From the sources

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. The issue affects Actions V1, and host command execution is not established. This issue is fixed in versions 3.4.13 and 4.16.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_