zenml-io zenml up to 0.94.2 Rate Limiting X-Forwarded-For access control

Summaryinfo

A vulnerability was found in zenml-io zenml up to 0.94.2. It has been rated as critical. The impacted element is an unknown function of the component Rate Limiting. Performing a manipulation of the argument X-Forwarded-For results in access control. This vulnerability is identified as CVE-2026-11922. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as critical has been found in zenml-io zenml up to 0.94.2. This affects an unknown function of the component Rate Limiting. The manipulation of the argument X-Forwarded-For with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.

It is possible to read the advisory at huntr.com. This vulnerability is uniquely identified as CVE-2026-11922 since 06/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 0.95.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• zenml-io

Name

• zenml

Version

• 0.94.0
• 0.94.1
• 0.94.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion