PT-2026-64225 · Zenml Io · Zenml-Io/Zenml

CVE-2026-11922 · Publicado 2026-07-24 · Atualizado 2026-07-24

NVD

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the X-Forwarded-For header when Uvicorn is launched with --proxy-headers --forwarded-allow-ips *. This configuration allows clients to control the value of request.client.host, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.

Correção

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-290

Identificadores relacionados

CVE-2026-11922

Produtos afetados

Zenml-Io/Zenml

Referências · 3

• https://github.com/zenml-io/zenml/commit/8a2214bdd63eb8200ce4719d82c6f0d935e922d1 · Nota
• https://huntr.com/bounties/3cb8bf6a-ae55-4b38-8da3-601c666a210e · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-11922 · Nota de Segurança