CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml
Attackers can bypass rate limits on login endpoints by spoofing IP headers, enabling unthrottled credential guessing attacks against ZenML users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-11922?
CVE-2026-11922 is a medium-severity vulnerability in zenml-io/zenml, published on 24 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configuration allows clients to control the value of `request.client.host`, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.
Weakness: CWE-290
Which versions are affected by CVE-2026-11922?
How do I fix CVE-2026-11922?
No fix has been published for CVE-2026-11922 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-11922 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-11922 exists.
Sources
Also known as GHSA-4vf6-f9c7-q6rp.