# CVE-2026-11922: ZenML rate limit bypass in login and password-change endpoints

Source: https://junglewise.ai/threats/cve-2026-11922-zenml-rate-limit-bypass-in-login-and-password-change-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-24. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-11922 · Severity: medium · CVSS 6.5 · Published 2026-07-24

ZenML, an open-source MLOps framework, contains a security flaw that allows attackers to bypass login protection mechanisms. By manipulating network headers, an attacker can trick the system into ignoring rate limits, enabling them to perform unlimited password-guessing attempts. This increases the risk of unauthorized account access and potential data breaches within the machine learning environment.

Technologies: [ZenML](https://junglewise.ai/threats/technologies/zenml). Vendors: [ZenML](https://junglewise.ai/threats/vendors/zenml).

## Quick answers

**Is CVE-2026-11922 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11922 being exploited in the wild.

**How severe is CVE-2026-11922?** Medium severity, with a CVSS score of 6.5, published 24 July 2026.

**Which products and versions are affected?** ZenML 0.57.0 through 0.94.2.

**Is there a fix for CVE-2026-11922?** A patch was published on 2026-07-24: Fix committed to GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11922 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-11922?** Check whether you run ZenML at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

ZenML versions 0.57.0 through 0.94.2 are vulnerable to a rate-limit bypass (CWE-290) on the `POST /api/v1/login` and self password-change endpoints. The vulnerability exists because the rate limiter keys requests based on `request.client.host`, which is derived from the `X-Forwarded-For` header when the Uvicorn server is configured with `--proxy-headers --forwarded-allow-ips *`. An attacker can rotate the value of this header to simulate different client origins, effectively resetting the rate limit counter for each request. This allows for high-speed brute-force or credential stuffing attacks. The issue is addressed in version 0.95.0 by changing how client identities are trusted and verified.

## Affected products

- zenml-io zenml 0.57.0 through 0.94.2

## Timeline

- 2026-07-24: advisory: NVD publication date
- 2026-07-24: disclosed: Initial disclosure via huntr.dev
- 2026-07-24: patched: Fix committed to GitHub repository

## References

- [https://github.com/zenml-io/zenml/commit/8a2214bdd63eb8200ce4719d82c6f0d935e922d1](https://github.com/zenml-io/zenml/commit/8a2214bdd63eb8200ce4719d82c6f0d935e922d1)
- [https://huntr.com/bounties/3cb8bf6a-ae55-4b38-8da3-601c666a210e](https://huntr.com/bounties/3cb8bf6a-ae55-4b38-8da3-601c666a210e)

## Related threats

- [zenml-io ZenML missing authorization in stack deployment endpoint](https://junglewise.ai/threats/cve-2026-11876-zenml-io-zenml-missing-authorization-in-stack-deployment-endpoint)
- [ZenML reflected cross-site scripting in survey redirect](https://junglewise.ai/threats/cve-2024-5062-zenml-reflected-cross-site-scripting-in-survey-redirect)