Zitadel’s Action V2 allows developers to configure webhooks that trigger when identity events occur. The configured target URL for an action can point to any host, including localhost or private IP ranges. When an action is executed, the Zitadel server performs an outbound HTTP request to the supplied URL. This behavior can be abused as a server‑side request forgery, enabling an attacker to probe internal services, discover network topology, or access restricted resources that are otherwise unreachable from the public internet. The vulnerability is mitigated by the fact that the server expects responses to match specific schemas, limiting the usefulness of arbitrary payloads, but discovery and reconnaissance remain possible.

The vulnerability affects Zitadel, an open‑source identity management platform, from Action V2 preview releases beginning at version 2.59.0, through the beta releases in the 3.x series, and up to the GA releases of the 4.x line through version 4.11.0. The issue is resolved in version 4.11.1 and later, where outbound action URLs are validated against a denylist that blocks localhost and loopback IPs. Earlier 4.x releases, as well as all 3.x and 2.x iterations, do not contain the fix.

The CVSS score of 2.1 indicates low overall severity, and the EPSS score of less than 1% reflects a very low probability that exploit attempts are currently observed. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need the ability to create or modify Action V2 configurations to exploit the SSRF vector. Once a vulnerable action exists, the attacker can use the resulting outbound request to collect information about internal hosts or services. The impact is primarily limited to internal reconnaissance and potential access to isolated services, rather than full system compromise or arbitrary code execution.