CVE-2026-11922 in zenml
Summary
by MITRE • 07/24/2026
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within the zenml-io/zenml application ecosystem affecting versions ranging from 0.57.0 through 0.94.2, presenting a critical security weakness that directly undermines authentication protections. The flaw stems from improper handling of client identification within the rate-limiting mechanism, specifically targeting the login and password change endpoints where attackers can exploit a configuration oversight to circumvent protective measures.
The technical implementation of this vulnerability relies on the application's use of Uvicorn with specific proxy headers enabled through the `--proxy-headers --forwarded-allow-ips *` flags. When these configurations are active, the system derives the client host information from the `X-Forwarded-For` HTTP header rather than the actual network connection source. This design choice creates a fundamental security gap because the `X-Forwarded-For` header is a standard HTTP header that can be manipulated by any client connecting to the service, allowing malicious actors to essentially spoof their IP addresses at will.
The operational impact of this vulnerability is severe and directly enables credential stuffing and brute force attacks against authentication endpoints. Attackers can rotate the `X-Forwarded-For` header values to bypass rate-limiting restrictions that would normally prevent excessive login attempts or password change requests. This creates an environment where automated attack tools can rapidly test credential combinations without encountering the intended throttling protections, significantly increasing the probability of successful unauthorized access.
The vulnerability maps directly to CWE-305 Authentication Bypass Through User-Controlled Key and aligns with ATT&CK technique T1110.003 Credential Stuffing, as it enables attackers to perform automated credential testing at an uncontrolled rate. This flaw represents a classic case of improper input validation where the system trusts user-supplied headers without proper verification or sanitization. The configuration allows for arbitrary header manipulation while the rate-limiting logic depends on these potentially falsified values for its decision-making process.
Organizations should immediately implement mitigations by either disabling proxy headers functionality when not required, or by implementing additional authentication controls such as account lockout mechanisms and multi-factor authentication. Alternative solutions include modifying the rate-limiting algorithm to use more secure identification methods that cannot be easily spoofed by clients. The proper fix involves ensuring that client identification for rate-limiting purposes is derived from trusted network source information rather than potentially manipulated HTTP headers, which would require a change in how the application handles reverse proxy configurations and authentication throttling mechanisms.
This vulnerability demonstrates the critical importance of understanding how web server configurations interact with application security controls, particularly in environments using reverse proxies where header manipulation can have significant implications for access control and rate-limiting protections. The issue highlights the need for comprehensive security testing that includes configuration validation and proper input sanitization practices across all application layers that handle authentication and access control functions.