CVE-2026-58165 is a privilege escalation vulnerability in OpenZiti ziti through version 2.0.0. The vulnerability arises from the ApplyCreate function in controller/model/enrollment_manager.go, which verifies only the existence of the target identity without enforcing authorization checks that bind the caller to that identity. Authenticated non-admin identities with fine-grained enrollment management permissions can exploit this to create enrollments for any identity, including the default administrator. The attacker can then redeem the one-time token via the unauthenticated client API enrollment endpoint to obtain a client certificate authenticating as the targeted admin identity, resulting in full administrative control over the controller and the zero-trust overlay it manages. The issue is fixed in a commit identified as 3027fdf.

Successful exploitation allows an authenticated non-admin user with enrollment management permissions to escalate privileges to full administrative control of the OpenZiti controller and the zero-trust overlay network it manages. This includes the ability to impersonate the default administrator identity, compromising confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 3027fdf; users should apply this fix when available. Until patched, restrict enrollment management permissions to trusted administrators only and monitor for suspicious enrollment creation activities.