A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.client.host`, which is derived from the `X-Forwarded-For` header when Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *`. This configura [truncated]
CVE-2026-11876 is an information disclosure vulnerability in zenml-io/zenml version 0.94.2. The `GET /api/v1/stack-deployment/stack` endpoint lacks proper Role-Based Access Control (RBAC) authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector information, and user IDs of stack owners. The [truncated]
