ZITADEL Actions V1 Sandbox Escape via File System Access

ZITADEL versions 3.x (< 3.4.13) and 4.x (< 4.16.1) contain a high-severity vulnerability (CVE-2026-85057) that enables a sandbox escape from the ZITADEL Actions V1 environment. Actions in ZITADEL are triggered during OIDC, SAML, and login flows, executing custom JavaScript within the server process using the goja Node-compatible engine.

The vulnerability stems from the engine's require() module loader, which was improperly configured to allow loading files from the host filesystem rather than restricting imports to authorized zitadel/* modules. Because the ZITADEL process must have read access to certain configuration files and secrets to function, an attacker with org.action.write or org.flow.write permissions (typically held by an ORG_OWNER) can craft malicious scripts to read these files. This is particularly critical in deployments where bootstrap credentials like the Login Client PAT or machine keys are stored in locations reachable by the API process, allowing attackers to escalate privileges from an organization-level administrator to an instance-wide administrator.

Impact

Successful exploitation collapses multi-tenant isolation, granting an organization administrator unauthorized access to host-level secrets and sensitive credentials. In self-hosted environments that follow documented bootstrap patterns, this leads to full instance control (IAM_OWNER). The vulnerability impacts all ZITADEL deployments utilizing Actions V1 on affected versions.

Recommendation

• Upgrade ZITADEL 4.x deployments to version 4.16.1 or later immediately.
• Upgrade ZITADEL 3.x deployments to version 3.4.13 or later immediately.
• In multi-tenant environments, strictly limit the assignment of org.action.write and org.flow.write permissions to trusted administrators only.
• Audit existing Action scripts for the presence of require() calls referencing filesystem paths.
• Remove or relocate bootstrap credentials (e.g., login-client.pat, machine keys) to volumes or locations not accessible by the ZITADEL API process user.