# CVE-2026-105214: Zitadel server-side request forgery in domain verification

Source: https://junglewise.ai/threats/cve-2026-105214-zitadel-before-4-16-2-contains-a-server-side-request-forgery  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-04. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-105214 · Severity: info · Published 2026-10-04

Zitadel is an open-source identity and access management platform used for authentication and user management. The vulnerability allows attackers to register domains that redirect the server to internal IP addresses or cloud metadata endpoints, potentially allowing them to map internal networks, scan internal ports, or interact with unauthorized internal services. Exploitation requires an attacker to control a domain and have the ability to create an organization.

Technologies: [ZITADEL](https://junglewise.ai/threats/technologies/zitadel). Vendors: [ZITADEL](https://junglewise.ai/threats/vendors/zitadel).

## Quick answers

**Is CVE-2026-105214 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105214 being exploited in the wild.

**How severe is CVE-2026-105214?** Informational severity, published 4 October 2026.

**Which products and versions are affected?** ZITADEL 4.0.0 through 4.16.1; 3.0.0 through 3.4.13.

**Is there a fix for CVE-2026-105214?** Yes: fixed in Zitadel 4.16.2. Until then: If immediate upgrade to 4.16.2 is not possible, implement strict network egress firewalls or reverse proxy rules to block Zitadel from initiating outbound connections to internal networks, loopback interfaces, and cloud metadata endpoints. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105214 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-105214?** Check whether you run ZITADEL at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Zitadel 4.16.2

If immediate upgrade to 4.16.2 is not possible, implement strict network egress firewalls or reverse proxy rules to block Zitadel from initiating outbound connections to internal networks, loopback interfaces, and cloud metadata endpoints.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in Zitadel's organization domain HTTP verification mechanism. The vulnerability arises because domain ownership verification uses Go's default http.Get instead of the protected HTTP client with internal network denylist, DNS rebinding protection, and redirect controls. An attacker can register an organization-controlled domain that redirects to loopback, internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), or cloud metadata endpoints (169.254.169.254), allowing network reconnaissance and potential access to internal services.

## Affected products

- Zitadel Zitadel 4.0.0 through 4.16.1; 3.0.0 through 3.4.13

## Timeline

- 2026-07-29: disclosed
- 2026-10-04: advisory

## References

- [https://github.com/zitadel/zitadel/security/advisories/GHSA-93hm-8q29-c8cr](https://github.com/zitadel/zitadel/security/advisories/GHSA-93hm-8q29-c8cr)
- [https://www.vulncheck.com/advisories/zitadel-before-4.16.2-ssrf-via-organization-domain-http-verification](https://www.vulncheck.com/advisories/zitadel-before-4.16.2-ssrf-via-organization-domain-http-verification)

## Related threats

- [ZITADEL missing authorization in Login V2 device authorization](https://junglewise.ai/threats/cve-2026-119129-zitadel-3-0-0-through-3-4-15-and-4-0-0-before-4-19-5-contains-a)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-119128-zitadel-4-0-0-before-4-19-5-contains-an-authentication-bypass)
- [ZITADEL Login V2 host header injection in password reset](https://junglewise.ai/threats/cve-2026-119127-zitadel-4-0-0-before-4-19-5-contains-a-host-header-injection)
- [ZITADEL privilege escalation in OIDC token exchange](https://junglewise.ai/threats/cve-2026-109374-zitadel-3-0-0-before-4-19-2-contains-a-privilege-escalation)
- [ZITADEL authentication bypass in Login V2 UI](https://junglewise.ai/threats/cve-2026-109373-zitadel-3-0-0-before-4-19-2-contains-an-authentication-bypass)