CVE-2026-11922
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
ZenML versions 0.57.0 through 0.94.2 have a vulnerability that allows bypassing rate-limiting on login and password change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from this header.
Risk Assessment
An attacker can perform unlimited brute-force attacks on user passwords, potentially leading to account takeover.
Recommendation
Update ZenML to a version above 0.94.2, where the issue has been fixed. Consider changing Uvicorn configuration to not rely on the X-Forwarded-For header for rate-limiting.
Other vulnerabilities in ZenML
See all- CVE-2026-68772High
ZenML 0.94.6 contains a remote code execution vulnerability in the CloudpickleMaterializer component that allows attackers with write access to a shared artifact store to execute arbitrary code by planting a malicious pickle file. Attackers can replace a stored artifact.pkl file with a crafted cloudpickle payload containing a malicious __reduce__ method, which executes arbitrary system commands when any user or pipeline materializes the artifact.
- CVE-2026-11876Medium
Vulnerability in zenml-io/zenml version 0.94.2. The `GET /api/v1/stack-deployment/stack` endpoint lacks proper RBAC checks, allowing any authenticated user to enumerate all deployed stacks (including component details, service connector info, and owner IDs) across all tenants.
Original NVD description (English source)
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.