What’s Vulnerable › Vulnerabilities

CVE-2026-11922: Rate-limit Bypass in zenml-io/zenml

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-24 · updated 2026-10-24
• Weakness: CWE-290

Description

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.

Affected products

• zenml-io/zenml: before 0.95.0 — fixed in 0.95.0

How to fix

Upgrade to a fixed version: zenml-io/zenml 0.95.0. Check the vendor advisory for mitigations.

References

• https://github.com/zenml-io/zenml/commit/8a2214bdd63eb8200ce4719d82c6f0d935e922d1
• https://huntr.com/bounties/3cb8bf6a-ae55-4b38-8da3-601c666a210e
• https://huntr.com/bounties/3cb8bf6a-ae55-4b38-8da3-601c666a210e

Get alerted when CVE-2026-11922 or the next vulnerability affects your stack