Vulnerability · Published Jul 24, 2026 · Assigned by @huntr_ai
CVE-2026-11922Rate-limit Bypass in zenml-io/zenml
Medium 6.5
In plain English
A medium-severity authentication bypass by spoofing in zenml-io/zenml from zenml-io. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| zenml-io | zenml-io/zenml | unspecified – before 0.95.0 |
Weakness: CWE-290 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N