OpenZiti CVE-2026-58165

The attacker must already possess a valid, authenticated non-admin OpenZiti identity that has been granted fine-grained enrollment-management (entity-level enrollment create) permissions - this delegated permission is the exact prerequisite. With it, no further special configuration is required: the create-enrollment call succeeds against any target identity including the default admin, and the resulting one-time token is redeemed through the normally unauthenticated client API enrollment endpoint. Limiting factors: exploitation is impossible without that enrollment-management grant (PR:L in the vector), so deployments that never delegate enrollment management to non-admins are not exposed; the attacker also needs network reachability to both the management API (to create) and the client enrollment endpoint (to redeem). Affected versions are OpenZiti through 2.0.0.

All decision signals point to a genuine, high-priority issue rather than a high-CVSS paper risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H, score 8.7) indicates remote, low-complexity exploitation needing only low privileges and no user interaction, with full compromise of confidentiality, integrity, and availability of the controller. The privilege requirement is real but low - an attacker needs an existing non-admin identity that has been granted enrollment-management permissions, which limits exposure to environments using fine-grained delegated administration. Exploit code/details are publicly available (VulnCheck advisory and issue #4010) and a vendor patch exists, which typically increases near-term exploitation likelihood. EPSS and CISA KEV data were not provided; absence of KEV is not evidence of non-exploitation, only that active in-the-wild use is unconfirmed here. The technical impact is total (admin of the overlay), so for any OpenZiti deployment that delegates enrollment management to non-admins this should be treated as urgent.

An attacker who controls a low-privileged OpenZiti identity that has been delegated enrollment-management permissions calls the controller's create-enrollment API specifying the default administrator's identity as the target; because no authorization check binds caller to target, the controller mints a one-time enrollment token for the admin. The attacker then redeems that token through the unauthenticated client API enrollment endpoint, obtains a client certificate authenticating as the admin, and gains full administrative control of the controller and overlay. Publicly available exploit details (VulnCheck, issue #4010) lower the barrier; the CVSS network vector and low attack complexity make this straightforward once the prerequisite permission is held.