Executive brief
OpenZiti, a zero-trust networking platform, contains a security flaw that allows users with limited permissions to escalate their access to full administrator status. By exploiting a lack of authorization checks during the enrollment process, a non-admin user can generate a security token for the administrator account. This allows an attacker to take complete control of the network controller and the entire zero-trust environment it manages.
Technical details
A missing authorization check (CWE-862) exists in the ApplyCreate function within controller/model/enrollment_manager.go. While the system verifies that a target identity exists, it fails to ensure the caller is authorized to manage enrollments for that specific identity. An authenticated attacker with 'enrollment' entity permissions can create a one-time-token (OTT) for a target admin identity. By redeeming this token via the unauthenticated client API enrollment endpoint (POST /edge/client/v1/enroll/ott), the attacker obtains a client certificate with isAdmin=true. This vulnerability was fixed in commit 3027fdf and is addressed in versions following 2.0.0.
Affected products
- OpenZiti Ziti Through 2.0.0
Timeline
- 2026-06-19: disclosed: Issue reported via GitHub and fix developed
- 2026-06-26: patched: Fix merged into main branch via commit 3027fdf
- 2026-06-30: advisory: NVD and VulnCheck advisories published