CVE-2026-11922

Name of the Vulnerable Software and Affected Versions zenml-io/zenml versions 0.57.0 through 0.94.2

Description An issue allows attackers to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. When Uvicorn is launched with --proxy-headers --forwarded-allow-ips *, the rate limiter uses request.client.host to key requests, which is derived from the X-Forwarded-For header. This allows clients to manipulate the request.client.host value, bypassing protections and exposing the endpoints to unthrottled credential guessing attacks.

Recommendations Update zenml-io/zenml to a version later than 0.94.2. Avoid launching Uvicorn with the --proxy-headers --forwarded-allow-ips * configuration to prevent clients from controlling the request.client.host value.