What’s Vulnerable › Vulnerabilities

CVE-2024-32967: Zitadel exposes internal database user name and host information

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-01 · updated 2026-06-17
• Weakness: CWE-200

Description

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no workaround since a patch is already available. Users are advised to upgrade.

Affected products

• zitadel: before 2.45.7; from 2.46.0 before 2.46.7; from 2.47.0 before 2.47.10; from 2.48.0 before 2.48.5; from 2.49.0 before 2.49.5; from 2.50.0 before 2.50.3 — fixed in 2.45.7, 2.46.7, 2.47.10, 2.48.5, 2.49.5, 2.50.3

How to fix

Upgrade to a fixed version: zitadel 2.45.7, 2.46.7, 2.47.10, 2.48.5. Check the vendor advisory for mitigations.

References

• https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6
• https://github.com/zitadel/zitadel/releases/tag/v2.45.7
• https://github.com/zitadel/zitadel/releases/tag/v2.46.7
• https://github.com/zitadel/zitadel/releases/tag/v2.47.10
• https://github.com/zitadel/zitadel/releases/tag/v2.48.5
• https://github.com/zitadel/zitadel/releases/tag/v2.49.5
• https://github.com/zitadel/zitadel/releases/tag/v2.50.3
• https://github.com/zitadel/zitadel/security/advisories/GHSA-q5qj-x2h5-3945
• https://github.com/zitadel/zitadel/commit/b918603b576d156a08b90917c14c2d019c82ffc6
• https://github.com/zitadel/zitadel/releases/tag/v2.45.7
• https://github.com/zitadel/zitadel/releases/tag/v2.46.7
• https://github.com/zitadel/zitadel/releases/tag/v2.47.10

Get alerted when CVE-2024-32967 or the next vulnerability affects your stack