CVE-2026-11922
published 2026-07-24CVE-2026-11922: A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self…
PriorityP341medium6.5CVSS 3.0
AVNACLPRNUINSUCLILAN
EPSS
0.18%
7.7th percentile
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zenml-io | zenml-io_zenml | >= unspecified < 0.95.0 | 0.95.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
zenml-io zenml up to 0.94.2 Rate Limiting X-Forwarded-For access control
vuldb·2026-09-03·CVSS 6.5
CVE-2026-11922 [MEDIUM] zenml-io zenml up to 0.94.2 Rate Limiting X-Forwarded-For access control
A vulnerability was found in zenml-io zenml up to 0.94.2. It has been declared as critical. The affected element is an unknown function of the component Rate Limiting. Such manipulation of the argument X-Forwarded-For leads to improper access controls.
This vulnerability is referenced as CVE-2026-11922. It is possible to launch the attack remotely. No exploit is available.
It is recommended to upgrade the affected component.
GHSA
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-
ghsa_unreviewed·2026-07-24
CVE-2026-11922 [MEDIUM] CWE-290 A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-24
Published