Executive brief
ZenML, an open-source MLOps framework, contains a security flaw that allows attackers to bypass login protection mechanisms. By manipulating network headers, an attacker can trick the system into ignoring rate limits, enabling them to perform unlimited password-guessing attempts. This increases the risk of unauthorized account access and potential data breaches within the machine learning environment.
Technical details
ZenML versions 0.57.0 through 0.94.2 are vulnerable to a rate-limit bypass (CWE-290) on the `POST /api/v1/login` and self password-change endpoints. The vulnerability exists because the rate limiter keys requests based on `request.client.host`, which is derived from the `X-Forwarded-For` header when the Uvicorn server is configured with `--proxy-headers --forwarded-allow-ips *`. An attacker can rotate the value of this header to simulate different client origins, effectively resetting the rate limit counter for each request. This allows for high-speed brute-force or credential stuffing attacks. The issue is addressed in version 0.95.0 by changing how client identities are trusted and verified.
Affected products
- zenml-io zenml 0.57.0 through 0.94.2
Timeline
- 2026-07-24: advisory: NVD publication date
- 2026-07-24: disclosed: Initial disclosure via huntr.dev
- 2026-07-24: patched: Fix committed to GitHub repository