CVE-2026-85057
2 advisories.
Go/github.com/zitadel/zitadel CVE-2026-85057: high 8.7, EPSS 0.39%
ZITADEL: Actions V1 sandbox escape: host file read via require()
Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 or later.
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062331-baf6ed501b68Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.80.0-v2.20.0.20260717062331-baf6ed501b68 | - |
Fixed versions
| 1.80.0-v2.20.0.20260717062331-baf6ed501b68 |
Sources
- osv: GHSA-fgmf-7rf8-m6vf
- https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf
- https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7
- https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e
- https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d
- https://github.com/zitadel/zitadel
- https://github.com/zitadel/zitadel/releases/tag/v3.4.13
- https://github.com/zitadel/zitadel/releases/tag/v4.16.1
CVE-2026-85057 · published · modified · JSON
Go/github.com/zitadel/zitadel CVE-2026-85057: unknown, EPSS 0.39%
ZITADEL: Actions V1 sandbox escape: host file read via require() in github.com/zitadel/zitadel
Action: Upgrade github.com/zitadel/zitadel to 1.80.0-v2.20.0.20260717062331-baf6ed501b68 or later.
go get github.com/zitadel/zitadel@v1.80.0-v2.20.0.20260717062331-baf6ed501b68Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.80.0-v2.20.0.20260717062331-baf6ed501b68 | - |
Fixed versions
| 1.80.0-v2.20.0.20260717062331-baf6ed501b68 |
Sources
- osv: GO-2026-6591
- https://github.com/zitadel/zitadel/security/advisories/GHSA-fgmf-7rf8-m6vf
- https://github.com/zitadel/zitadel/commit/afe108640cf57a17e8b743fbcdad9ae636eb3eb7
- https://github.com/zitadel/zitadel/commit/baf6ed501b684f47048553d9034e8d3aa824950e
- https://github.com/zitadel/zitadel/commit/e28d6bcc033368c3e9683ee15c195b8460b9305d
- https://github.com/zitadel/zitadel/releases/tag/v3.4.13
- https://github.com/zitadel/zitadel/releases/tag/v4.16.1
CVE-2026-85057 · published · modified · JSON