CVE-2026-58165: OpenZiti Privilege Escalation via Enrollment Authorization Bypass

Technical summary

CVE-2026-58165 is a post-authentication privilege escalation in OpenZiti through version 2.0.0, stemming from insufficient authorization validation in the ApplyCreate function within controller/model/enrollment_manager.go. The enrollment manager verifies only that a target identity exists, not that the requesting principal has authorization to create enrollments for that target. An authenticated attacker holding fine-grained enrollment management permissions can invoke ApplyCreate to generate a one-time enrollment token for any identity, including the default administrator. The attacker then redeems this token through the unauthenticated client enrollment API endpoint, obtaining a valid client certificate bound to the target admin identity. This certificate authenticates the attacker to the controller with full administrative privileges. The fix, applied in commit 3027fdf, implements proper authorization checks binding the caller's permissions to the requested enrollment target.

Business impact

Compromise of the OpenZiti controller translates directly to control of the entire zero-trust overlay network. An insider or compromised low-privilege user can escalate to administrator, gaining the ability to modify access policies, enroll malicious identities, inspect encrypted traffic metadata, revoke legitimate access, or inject rogue endpoints. For organizations relying on OpenZiti to enforce network segmentation and secure remote access, this vulnerability undermines the security model's core assumption that administrative controls prevent unauthorized changes to trust relationships.

Affected systems

OpenZiti versions through 2.0.0 are affected. The vulnerability requires an authenticated identity with enrollment management permissions on the controller; however, depending on how OpenZiti is deployed, enrollment permissions may be delegated broadly. Systems that have not applied the fix in commit 3027fdf remain vulnerable.

Exploitability

Exploitability is moderate-to-high. The attack requires prior authentication and specific fine-grained permissions (enrollment management), narrowing the attacker pool to trusted insiders, compromised service accounts, or accounts obtained through credential theft. However, once an attacker holds these permissions—which may be granted to security teams, identity administrators, or automated provisioning services—the escalation path is straightforward and requires no user interaction or complex manipulation. The one-time token redemption occurs through an unauthenticated endpoint, meaning no further authentication is needed to complete the takeover.

Remediation

Organizations must upgrade to a version of OpenZiti containing the authorization fix (verify against the vendor advisory for the exact patched version number corresponding to commit 3027fdf). Interim compensating controls include strictly limiting enrollment management permissions to essential administrators only, implementing strong identity federation and MFA on privileged accounts, monitoring enrollment token issuance and certificate creation events, and reviewing audit logs for suspicious enrollment requests. Assume breach: if this vulnerability was exploitable in your environment, rotate all administrator credentials and review audit logs for unauthorized enrollments or certificate issuance.

Patch guidance

Apply the OpenZiti version containing commit 3027fdf. Verify the exact version number and availability through the vendor's security advisory and release notes. Follow standard change management procedures; the controller should be updated in a controlled maintenance window, as all enrolled identities depend on it. After patching, validate that the authorization checks are enforced by testing that non-admin identities can no longer create enrollments for other identities.

Detection guidance

Monitor controller logs and audit trails for: (1) enrollment creation requests where the requesting identity differs from the target identity, especially requests targeting administrative accounts; (2) rapid or unusual patterns of token generation; (3) certificate issuance events tied to unexpected identities; (4) access by low-privilege accounts to enrollment management APIs. Implement alerting on any enrollment token redemption for the default administrator or other high-value identities. Network detection is limited because the final escalation uses valid certificates, but anomalous policy changes or access patterns post-compromise may reveal the attack.

Why prioritize this

This vulnerability should be prioritized immediately if OpenZiti is deployed in your environment. The CVSS 3.1 score of 8.8 (HIGH) reflects the severity: it requires authentication but grants full administrative control. In zero-trust architectures, the controller is the trust anchor; its compromise is equivalent to compromising Active Directory or a root CA. Even organizations with strong perimeter defenses depend on OpenZiti's policy engine to enforce least-privilege access. A single malicious or compromised identity with enrollment permissions can bypass all downstream security controls.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects a HIGH severity rating. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network-accessible exploitation (AV:N), low attack complexity (AC:L), requirement for low-level privileges (PR:L), no user interaction (UI:N), and impact on confidentiality, integrity, and availability within the same security boundary (S:U/C:H/I:H/A:H). The requirement for prior authentication and specific permissions prevents a score above 9.0, but the direct path to administrator control and full system compromise justifies the high rating.

Frequently asked questions