CVE-2026-58165 is a privilege escalation vulnerability in OpenZiti ziti (<=2.0.0) where the ApplyCreate function in controller/model/enrollment_manager.go verifies only the existence of the target identity without enforcing authorization checks binding the caller to that identity. Authenticated non-admin identities with fine-grained enrollment management permissions can create enrollments for any identity, including the default administrator. The attacker can then redeem the one-time token via the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, resulting in full administrative control of the controller and the zero-trust overlay it manages.

Successful exploitation allows an authenticated non-admin user with enrollment management permissions to escalate privileges to full administrative control of the OpenZiti controller and its zero-trust overlay network. This includes the ability to impersonate the default administrator identity, compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in a commit identified as 3027fdf, but no official patch or release information is provided. Until an official fix is available, restrict enrollment management permissions to trusted administrators only and monitor for suspicious enrollment activity.