CVE-2026-11922

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-11922
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11922.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-11922
Published
2026-07-24T03:27:39.188Z
Modified
2026-07-27T03:56:36.616928553Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Rate-limit Bypass in zenml-io/zenml
Details

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the X-Forwarded-For header when Uvicorn is launched with --proxy-headers --forwarded-allow-ips *. This configuration allows clients to control the value of request.client.host, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.

Database specific 
{
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/11xxx/CVE-2026-11922.json",
    "cwe_ids": [
        "CWE-290"
    ]
}
References

Affected packages

Git / github.com/zenml-io/zenml

Affected ranges

Type
GIT
Repo
https://github.com/zenml-io/zenml
Events
Introduced
dab417c864d0fb8a42ae0a6993698390bb0548d7
Fixed
0f3a0533072395475df9be6d82b907a58f09be28
Fixed
8a2214bdd63eb8200ce4719d82c6f0d935e922d1
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0.57.0"
        },
        {
            "fixed": "0.94.2"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.57.0
0.57.1
0.58.0
0.58.1
0.58.2
0.60.0
0.62.0
0.63.0
0.64.0
0.65.0
0.66.0
0.67.0
0.68.0
0.70.0
0.71.0
0.72.0
0.73.0
0.74.0
0.75.0
0.80.0
0.80.1
0.80.2
0.81.0
0.82.0
0.82.1
0.83.0
0.83.1
0.84.0
0.84.1
0.84.2
0.84.3
0.85.0
0.91.0
0.91.2
0.92.0
0.93.2
0.93.3
0.94.0
0.94.0rc0
0.94.1
0.94.2
0.94.3
0.94.4
0.94.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-11922.json"