CVE-2026-11922 Details
Description
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.
A vulnerability in ZenML versions 0.57.0 through 0.94.2 allows attackers to bypass rate limiting on the login and self password-change endpoints. This is achieved by rotating the X-Forwarded-For header, which manipulates the request.client.host value used by the rate limiter. The issue arises when Uvicorn is configured to trust proxy headers, enabling clients to control the IP address seen by the server. As a result, attackers can flood the login endpoint with credential guesses without being throttled, potentially leading to account takeover.
Users can restrict the 'X-Forwarded-For' header handling by configuring their server to sanitize or overwrite incoming proxy headers before they reach ZenML. Additionally, ZenML's rate limiting can be keyed to the username being authenticated, rather than the IP address, to provide more effective protection against credential stuffing attacks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-290 | Authentication Bypass by Spoofing | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Modified | CISA-ADP |
| Jul 24, 2026 | New CVE Received | [email protected] |