Auth bypass in Openziti Ziti
CVE-2026-58165
OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate function in controller/model/enrollment_manager.go verifies only that the target identity exists without performing authorization checks binding the caller to the target identity. Attackers can redeem the resulting one-time token through the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, yielding full administrative control of the controller and the zero-trust overlay it manages.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (24.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 25th percentile — 24.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Openziti Ziti — versions 0, 3027fdffd3e57884487b7c46e5e669cfbc8becdf
Weakness classification (CWE)
References
- github.com/openziti/ziti/issues/4010 (technical-description, exploit)
- github.com/openziti/ziti/pull/4013 (issue-tracking)
- github.com/openziti/ziti/commit/3027fdffd3e57884487b7c46e5e669cfbc8becdf (patch)
- www.vulncheck.com/advisories/openziti-privilege-escalation-to-admin-via-unautho… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-58165?
- CVE-2026-58165 is a high-severity vulnerability in Openziti Ziti, classified under Missing Authorization. CVSS score: 8.8/10. Published 2026-06-30.
- How severe is CVE-2026-58165?
- High severity. CVSS v3 base score is 8.8 out of 10.