Quick answers
- Is CVE-2026-11922 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11922 being exploited in the wild.
- How severe is CVE-2026-11922?
- Medium severity, with a CVSS score of 6.5, published 24 July 2026.
- Which products and versions are affected?
- ZenML 0.57.0 through 0.94.2.
- Is there a fix for CVE-2026-11922?
- A patch was published on 2026-07-24: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11922 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-11922?
- Check whether you run ZenML at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
ZenML versions 0.57.0 through 0.94.2 are vulnerable to a rate-limit bypass (CWE-290) on the `POST /api/v1/login` and self password-change endpoints. The vulnerability exists because the rate limiter keys requests based on `request.client.host`, which is derived from the `X-Forwarded-For` header when the Uvicorn server is configured with `--proxy-headers --forwarded-allow-ips *`. An attacker can rotate the value of this header to simulate different client origins, effectively resetting the rate limit counter for each request. This allows for high-speed brute-force or credential stuffing attacks. The issue is addressed in version 0.95.0 by changing how client identities are trusted and verified.
Affected products
- zenml-io zenml 0.57.0 through 0.94.2
Timeline
- 2026-07-24: advisory: NVD publication date
- 2026-07-24: disclosed: Initial disclosure via huntr.dev
- 2026-07-24: patched: Fix committed to GitHub repository