Detections
Analytics

SCA: security update for github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 (GHSA-7wfc-4796-gmg5)

high Tenable Self-Hosted Container Security Plugin ID 436303

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an
 unauthenticated, full-read SSRF vulnerability. The ZITADEL Login UI (V2) treats the x-zitadel-forward-host
 header as a trusted fallback for all deployments, including self-hosted instances. This allows an
 unauthenticated attacker to force the server to make HTTP requests to arbitrary domains, such as internal
 addresses, and read the responses, enabling data exfiltration and bypassing network-segmentation controls.
 This issue is fixed in version 4.7.1. (CVE-2025-67494)

See Also

https://github.com/advisories/GHSA-7wfc-4796-gmg5

Plugin Details

Severity: High

ID: 436303

Version: Revision 1.8

Type: Local

Family: SCA Checks

Published: 12/9/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 51.27

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2025-67494

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 12/8/2025

Vulnerability Publication Date: 12/8/2025

Reference Information

CVE: CVE-2025-67494

cwe: CWE-918