Repository navigation
v4.17.3
📦 zitadel — v4.17.3
Release type: latest • Commit:
739cbc0
Security:
Image Availability
zitadel
| Registry | Reference | Tags |
|---|---|---|
| GitHub Container Registry | ghcr.io/homelabhd/zitadel |
v4.17.3 · latest |
| Docker Hub | docker.io/hlhd/zitadel |
v4.17.3 · latest |
| cr.pcfae.com | cr.pcfae.com/hlhd/zitadel |
v4.17.3 · latest |
zitadel-login
| Registry | Reference | Tags |
|---|---|---|
| GitHub Container Registry | ghcr.io/homelabhd/zitadel-login |
v4.17.3 · latest |
| Docker Hub | docker.io/hlhd/zitadel-login |
v4.17.3 · latest |
| cr.pcfae.com | cr.pcfae.com/hlhd/zitadel-login |
v4.17.3 · latest |
Digest pull commands & supply chain artifacts
docker.io/hlhd/zitadel
docker pull docker.io/hlhd/zitadel@sha256:8591ee57f33c924ffab2409b7ed9d76d1128ac652452839ddafba24db5387c5b
docker.io/hlhd/zitadel-login
docker pull docker.io/hlhd/zitadel-login@sha256:fd49ee3641fa9123db3316ff0f97a1d705d215094c213fd67d3c20813fcaf024
cr.pcfae.com/hlhd/zitadel
docker pull cr.pcfae.com/hlhd/zitadel@sha256:8591ee57f33c924ffab2409b7ed9d76d1128ac652452839ddafba24db5387c5b
cr.pcfae.com/hlhd/zitadel-login
docker pull cr.pcfae.com/hlhd/zitadel-login@sha256:fd49ee3641fa9123db3316ff0f97a1d705d215094c213fd67d3c20813fcaf024
ghcr.io/homelabhd/zitadel
docker pull ghcr.io/homelabhd/zitadel@sha256:8591ee57f33c924ffab2409b7ed9d76d1128ac652452839ddafba24db5387c5b
ghcr.io/homelabhd/zitadel-login
docker pull ghcr.io/homelabhd/zitadel-login@sha256:fd49ee3641fa9123db3316ff0f97a1d705d215094c213fd67d3c20813fcaf024
Highlights
- lint: exclude internal/static/i18n from lint (upstream en.yaml duplicate key)
- login-v2: honor project private labeling (zitadel#10692) + self-contained builds [v4.17.3 base]
- crypto: use authenticated encryption for IDP intent tokens
- security: check auth method permission on the user's organization
- login: authorize IDP linking via enrollment guard, not isSessionValid
- login: translate authentication and OTP strings (zitadel#12668)
Notable Changes
Bug Fixes
- lint: exclude internal/static/i18n from lint (upstream en.yaml duplicate key) (SoFMeRight)
- login-v2: honor project private labeling (zitadel#10692) + self-contained builds [v4.17.3 base] (SoFMeRight)
- crypto: use authenticated encryption for IDP intent tokens (Livio Spring)
- security: check auth method permission on the user's organization (Marco A.)
- login: authorize IDP linking via enrollment guard, not isSessionValid (gayathri)
- login: translate authentication and OTP strings (zitadel#12668) (Matías Racedo)
Documentation
- perf: v4.17.1 results and harness fixes (zitadel#12651) (Tim Möhlmann)
Maintenance
- governance: carry SF config onto the v4.17.3 base (SoFMeRight)
- gRPC-Go deps update to 1.83.2 (zitadel#12680) (Marco A.)
Security
Vulnerability details (3 high, 10 medium, 8 low)
| Severity | CVE | Package | Installed | Fixed | Description |
|---|---|---|---|---|---|
| High | CVE-2026-46600 | stdlib | go1.25.14 | 1.26.6 | Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. |
| High | GO-2026-6355 | golang.org/x/crypto | v0.55.0 | 0.56.0 | Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global... |
| High | GO-2026-6354 | golang.org/x/crypto | v0.55.0 | 0.56.0 | Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection... |
| Medium | CVE-2025-24358 | github.com/gorilla/csrf | v1.7.2 | 1.7.3 | gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention mid ... |
| Medium | CVE-2025-47909 | github.com/gorilla/csrf | v1.7.2 | — | Hosts listed in TrustedOrigins implicitly allow requests from the corr ... |
| Medium | CVE-2026-81871 | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc | v0.19.0 | 0.21.0 | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration |
| Medium | CVE-2026-81872 | go.opentelemetry.io/otel/sdk/log | v0.19.0 | 0.21.0 | go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission |
| Medium | CVE-2026-56855 | golang.org/x/crypto | v0.55.0 | 0.56.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages |
| Medium | CVE-2026-78662 | golang.org/x/crypto | v0.55.0 | 0.56.0 | golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding |
| Medium | GHSA-hjf4-fphr-2h65 | go.opentelemetry.io/otel/sdk/log | v0.19.0 | 0.21.0 | OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full |
| Medium | GHSA-rq77-p4h8-4crw | github.com/gorilla/csrf | v1.7.2 | 1.7.3 | gorilla/csrf CSRF vulnerability due to broken Referer validation |
| Medium | GHSA-w34q-cm8f-9c5x | go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc | v0.19.0 | 0.21.0 | OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning |
| Medium | GHSA-82ff-hg59-8x73 | github.com/gorilla/csrf | v1.7.2 | — | github.com/gorilla/csrf improperly validates TrustedOrigins allowing CSRF attacks |
| Low | CVE-2026-81870 | go.opentelemetry.io/otel/exporters/otlp/otlptrace | v1.43.0 | 1.45.0 | github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging |
| Low | CVE-2026-81870 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc | v1.43.0 | 1.45.0 | github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging |
| Low | CVE-2026-81870 | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp | v1.43.0 | 1.45.0 | github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging |
| Low | CVE-2026-81870 | go.opentelemetry.io/otel/sdk | v1.44.0 | 1.45.0 | github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/otel/exporters/otlp/otlptrace | v1.43.0 | 1.45.0 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc | v1.43.0 | 1.45.0 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp | v1.43.0 | 1.45.0 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
| Low | GHSA-8wmf-6v46-5gfg | go.opentelemetry.io/otel/sdk | v1.44.0 | 1.45.0 | OpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logs |
Full changelog
- [
739cbc0] exclude internal/static/i18n from lint (upstream en.yaml duplicate key) (SoFMeRight) - [
ef7f04d] carry SF config onto the v4.17.3 base (SoFMeRight) - [
d9c4aff] honor project private labeling (zitadel#10692) + self-contained builds [v4.17.3 base] (SoFMeRight) - [
41b1114] use authenticated encryption for IDP intent tokens (Livio Spring) - [
20f0984] check auth method permission on the user's organization (Marco A.) - [
a53fbc4] authorize IDP linking via enrollment guard, not isSessionValid (gayathri) - [
739e91e] translate authentication and OTP strings (zitadel#12668) (Matías Racedo) - [
20f006d] gRPC-Go deps update to 1.83.2 (zitadel#12680) (Marco A.) - [
a7b3f69] v4.17.1 results and harness fixes (zitadel#12651) (Tim Möhlmann)