NetBird: vendor install script leaves the ZITADEL admin account on its default password

Impact

Instances of self-hosted NetBird installed with the vendor's script keep the admin account that ZITADEL creates, with its default password, and the installer neither changes nor removes it. Anyone who can reach the login page gets administrator control of the identity provider behind the VPN control plane, which means minting peers, changing access policies and issuing themselves routes. Where NetBird is how operators and jump hosts reach a management VLAN or a cluster API, that is unauthenticated remote access to the network the fleet sits on, without touching any host. Docker-based deployments are affected too if the default user was never changed or removed.

Who can reach it

Anyone who can reach the NetBird/ZITADEL management UI, including over the internet where it is published. No credentials beyond the published defaults.

What to do

Upgrade to NetBird 0.57.0, which fixes the installer, and - separately - change the password on or delete the ZITADEL admin account on every instance already deployed, because upgrading does not clean up an account that is already there. Then audit the peer list, access policies and routes for entries you did not create, and rotate anything reachable through the VPN if the console was exposed.

References

Related entries

• BeyondTrust Remote Support appliance (internal message handling): Internal components of the Remote Support applianceCVE-2026-102764 · BeyondTrust Remote Support appliance (internal message handling)Critical
• Citrix NetScaler ADC and Gateway: unauthenticated remote compromise of the applianceCVE-2026-19490 · Citrix NetScaler ADC / GatewayCritical
• Backpropagate (single-GPU LLM fine-tuning library) - Reflex web UI: The optional web UI exposes a training controlCVE-2026-48797 · Backpropagate (single-GPU LLM fine-tuning library) - Reflex web UICritical
• Assisted Migration Agent (hardcoded insecure TLS to vCenter): The agent hardcodes insecure TLS when talking to vCenterCVE-2026-53475 · Assisted Migration Agent (hardcoded insecure TLS to vCenter)Critical
• Linux liquidio driver (Marvell/Cavium, cached VF pci_dev lookup table): The LiquidIO PF caches VF `pci_dev` pointersCVE-2026-72329 · Linux liquidio driver (Marvell/Cavium, cached VF pci_dev lookup table)Critical
• Dell Secure Connect Gateway: exposed Docker socket gives a local user or container host rootCVE-2026-80238 · Dell Secure Connect Gateway 5.0 (orchestrator container / exposed Docker socket)Critical