Tag
high
advisory
ZITADEL Actions V1 Sandbox Escape via File System Access
1 TTP 1 CVEAn insecure configuration of the goja JavaScript runtime in ZITADEL Actions V1 allows authenticated organization owners to perform a sandbox escape and read arbitrary host files via the require() module loader, leading to potential privilege escalation to instance administrator.
ZITADEL +1
privilege-escalation
sandbox-escape
cve-2026-85057
1t
1c
high
advisory
ZITADEL LDAP Filter Injection Vulnerability in Login Flow
2 rules 1 IOCZITADEL's LDAP identity provider implementation fails to properly escape user-provided usernames before incorporating them into LDAP search filters, allowing unauthenticated attackers to perform LDAP Filter Injection to enumerate usernames and extract sensitive attribute data.
ZITADEL +2
ldap-injection
information-disclosure
2r
1i