Which versions of OpenZiti are affected by CVE-2026-58165?

OpenZiti through version 2.0.0 contains a privilege escalation flaw that allows any authenticated user holding enrollment-management permissions to compromise the built-in administrator account and…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58165?

Yes, a public proof-of-concept exploit is available for CVE-2026-58165. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-58165?

24 hours: Identify all OpenZiti deployments and audit which users or service accounts hold enrollment-management permissions; assess exposure if untrusted or high-risk personnel possess these permissions. 7 days: Apply vendor-released patch to all OpenZiti instances (consult vendor advisory for your specific version's compatibility). 30 days: Conduct comprehensive audit of enrollment-management role assignments; enforce least-privilege principle by restricting permissions to minimal required set and implement approval workflows for critical identity enrollment operations.

OpenZiti CVE-2026-58165

Q: What is the CVSS score of CVE-2026-58165?

CVE-2026-58165 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-40371 HIGH

Missing Authorization (CWE-862)

2026-06-30 VulnCheck

GHSA-c883-vc4m-3vc9

Authentication Bypass Privilege Escalation Openziti Ziti

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Remote API call (AV:N) at low complexity (AC:L) requires an authenticated non-admin with delegated enrollment permission (PR:L) and no user interaction; redeeming the token yields full admin, so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 17:44 vuln.today

v5 (cvss_changed)

Source Code Evidence Fetched

Jun 30, 2026 - 17:43 vuln.today

Analysis Updated

Jun 30, 2026 - 17:43 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 17:42 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 17:22 NVD

8.8 (HIGH) 8.7 (HIGH)

Analysis Generated

Jun 30, 2026 - 17:15 vuln.today

DescriptionCVE.org

OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, including the default administrator, because the ApplyCreate function in controller/model/enrollment_manager.go verifies only that the target identity exists without performing authorization checks binding the caller to the target identity. Attackers can redeem the resulting one-time token through the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, yielding full administrative control of the controller and the zero-trust overlay it manages.

AnalysisAI

Privilege escalation in OpenZiti through 2.0.0 lets an authenticated non-admin identity that holds fine-grained enrollment-management permissions mint an enrollment for any identity - including the built-in default administrator - and then redeem the resulting one-time token via the unauthenticated client enrollment API to receive a client certificate that authenticates as that admin, granting full control of the controller and the entire zero-trust overlay. The root cause is a missing authorization check (CWE-862) in the enrollment creation path. Publicly available exploit details exist (reported by VulnCheck, GitHub issue #4010) and a vendor fix is available; no public exploit identified as actively used at time of analysis.

Technical ContextAI

OpenZiti is an open-source zero-trust networking overlay whose controller issues identities and brokers enrollment of edge clients/routers via X.509 certificates. Enrollment objects carry a one-time token (and JWT) that, when redeemed against the client API enrollment endpoint, mints a client certificate binding the bearer to a specific identity. The flaw lives in ApplyCreate in controller/model/enrollment_manager.go: it confirms only that the target identity exists, without an authorization check tying the calling identity to the target. This is a textbook CWE-862 Missing Authorization - the permission to manage enrollments was treated as sufficient, ignoring whose identity the enrollment is for. The PR (#4013, commit 3027fdf) adds checkNonAdminEnrollmentForIdentity / checkNonAdminAccessToEnrollment guards that block non-admins from creating, reading, refreshing, deleting, or listing enrollments belonging to admin identities (identity.IsAdmin). Affected component per CPE is cpe:2.3:a:openziti:ziti.

RemediationAI

Upgrade OpenZiti to the build containing the fix in commit 3027fdffd3e57884487b7c46e5e669cfbc8becdf (merged via pull request https://github.com/openziti/ziti/pull/4013); an upstream fix is available but the specific tagged released version was not provided, so confirm the exact patched release with the vendor before deploying. As an interim compensating control, audit and revoke fine-grained enrollment-management permissions from any non-admin identities, since the vulnerability is only reachable by callers holding that delegated permission - the trade-off is that legitimate delegated enrollment workflows are disrupted and must be performed by full admins. Additionally, monitor for and treat as suspicious any newly created enrollments targeting admin identities (especially the default administrator) and any unexpected certificate enrollments redeemed against the client API, and rotate/invalidate suspicious one-time tokens. Review the advisories at https://github.com/openziti/ziti/issues/4010 and https://www.vulncheck.com/advisories/openziti-privilege-escalation-to-admin-via-unauthorized-enrollment-creation for vendor guidance.