gematik ZETA Guard PEP
Server-Side Request Forgery via the Inner ASL Request-Target
The ZETA Guard Policy Enforcement Point (PEP) decrypts ASL-tunnelled requests and forwards the inner HTTP request to the backend it protects. The destination of that forwarded request follows the inner request-target, so an authenticated ZETA client can direct the PEP to any host reachable from it, choosing method, path, and body, and read the response if one is returned. Only a PEP with ASL enabled is affected, and only by a client holding valid credentials for a registered ZETA client.
This advisory contains limited information during coordinated disclosure. Please check back later for full details.
Description
ZETA Guard is gematik's open reference implementation of the Zero Trust Access (ZETA) architecture for the Telematikinfrastruktur; its Policy Enforcement Point terminates ASL-tunnelled client requests in front of the services it protects. Publishing the implementation as open source made this review possible, and we appreciate that transparency. We reported this finding privately to gematik through its Coordinated Vulnerability Disclosure Program in September 2026. gematik engaged with the report from the start, shipped fixed versions within four weeks, and published its own advisory with full credit. That is coordinated disclosure working as intended, and we thank the gematik team for it.
The fix hardens the PEP's handling of the inner ASL request-target so that an inner request can no longer select a different destination. This is a coordinated disclosure; the full technical writeup follows once the remediation window closes.
Impact
- Operators running a PEP with ASL enabled are directly affected: a malicious or compromised ZETA client can use the PEP to reach services that were never meant to be exposed to clients. Depending on what those services accept from the PEP, they could disclose records or accept state changes; where they hold health data, the insured persons and care providers behind them are the ones exposed. Exposure depends on network reachability from the PEP and on the destination's own authentication and authorization controls.
Mitigation
Update zeta-guard-ngx-pep to 1.3.3 (1.3 line) or 1.2.4 (1.2 line) or later. Where an update is not yet possible, disabling ASL support in the PEP removes the attack vector; the ZETA Guard Helm chart ships with ASL disabled by default since 1.3.1. Independently of the update, strict egress network policies limit which destinations the PEP can reach; see gematik's egress NetworkPolicy guide in the references.
References
- GHSA-2665-652j-3p4c (vendor advisory)
- zeta-guard-ngx-pep Release Notes (1.3.3)
- gematik zeta-guard-ngx-pep Repository
- gematik ZETA: Egress NetworkPolicy configuration guide
- zeta-guard-helm 1.3.1 values.yaml (ASL disabled by default)
- gematik Zero Trust Access (ZETA) Repository
- gemSpec_ZETA (gematik specification)
- gematik Coordinated Vulnerability Disclosure
How We Can Help
Who We Are
The security researchers behind this advisory.
Dr. rer. nat. Simon Weber
Senior Pentester & MedSec Researcher
I evaluate your SaMD with the same industry-defining security insight I contributed to the BAK MV for the revision of the B3S standard.
- PhD on Hospital Cybersecurity
- Critical vulnerabilities found in hospital systems
- Alumni of THB MedSec Research Group
- gematik Security Hero
Dipl.-Inf. Volker Schönefeld
Senior Application Security Expert
As a former CTO and developer turned pentester, I work alongside your team to uncover vulnerabilities and find solutions that fit your architecture.
- 20+ years as CTO, 50M+ app downloads
- Architected and secured large-scale IoT fleets
- Certified Web Exploitation Specialist
- gematik Security Hero
Looking for a Penetration Test?
Machine Spirits specializes in security assessments for medical devices and healthcare IT. From MDR penetration testing to C5 cloud compliance, we help MedTech companies meet regulatory requirements.