PatchSiren

zenml-io CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM zenml-io CVE published 2026-07-21

CVE-2026-11876

CVE-2026-11876 is an information disclosure vulnerability in zenml-io/zenml version 0.94.2. The `GET /api/v1/stack-deployment/stack` endpoint lacks proper Role-Based Access Control (RBAC) authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector information, and user IDs of stack owners. The [truncated]