OpenZiti versions up to 2.0.0 allow an authenticated identity that has fine‑grained enrollment‑management permissions to create an enrollment for any target identity, including the default administrator. The controller verifies only that the target identity exists, omitting an authorization check that would bind the caller to the target. By redeeming the one‑time token created for the unauthorized enrollment through the unauthenticated client‑API enrollment endpoint, an attacker obtains a client certificate that authenticates as the targeted admin identity, granting full administrative control of the controller and the zero‑trust overlay it manages.

Vendors and products impacted include OpenZiti (ziti) through version 2.0.0. The vulnerability is fixed in commit 3027fdf and in any release derived from that commit.

The CVSS score of 8.7 indicates a high‑severity vulnerability, and the EPSS score is not available, so current exploitation likelihood cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker first obtain authenticated access to the Ziti controller with enrollment‑management permissions; from there the attacker can create an unauthorized enrollment and elevate privileges to a full administrator. The impact is loss of confidentiality, integrity, and availability of all managed services.