CVE-2026-11876
MediumCVSS 5.0Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Vulnerability in zenml-io/zenml version 0.94.2. The `GET /api/v1/stack-deployment/stack` endpoint lacks proper RBAC checks, allowing any authenticated user to enumerate all deployed stacks (including component details, service connector info, and owner IDs) across all tenants.
Risk Assessment
An attacker can obtain sensitive infrastructure information, topology, and stack ownership, enabling reconnaissance and further attacks in multi-tenant ZenML Pro/Cloud deployments.
Recommendation
Update ZenML to a version with the RBAC fix. Restrict access to the endpoint to authorized users only.
Other vulnerabilities in ZenML
See all- CVE-2026-68772High
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact.
- CVE-2026-11922Medium
ZenML versions 0.57.0 through 0.94.2 have a vulnerability that allows bypassing rate-limiting on login and password change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from this header.
Original NVD description (English source)
In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector information, and user IDs of stack owners. The vulnerability arises from two issues: missing endpoint-level RBAC checks and the use of a server-side `Client()` that bypasses the RBAC enforcement layer by directly accessing the database through `SqlZenStore`. This exposes sensitive information such as infrastructure topology, service connector details, stack ownership, and deployment metadata, potentially enabling cross-tenant reconnaissance and further attacks in multi-tenant ZenML Pro/Cloud deployments.