EUVD-2026-46264
GHSA-7jmq-cfcx-7mr9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Network-accessible API requiring only authentication (PR:L); scope changes because cross-tenant reads occur; confidentiality impact limited to stack metadata.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
3DescriptionCVE.org
In zenml-io/zenml version 0.94.2, the GET /api/v1/stack-deployment/stack endpoint (get_deployed_stack) lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector information, and user IDs of stack owners. The vulnerability arises from two issues: missing endpoint-level RBAC checks and the use of a server-side Client() that bypasses the RBAC enforcement layer by directly accessing the database through SqlZenStore. This exposes sensitive information such as infrastructure topology, service connector details, stack ownership, and deployment metadata, potentially enabling cross-tenant reconnaissance and further attacks in multi-tenant ZenML Pro/Cloud deployments.
AnalysisAI
Missing RBAC authorization on the ZenML 0.94.2 get_deployed_stack endpoint allows any authenticated user to enumerate all deployed stacks across all users and tenants. The root failure is twofold: the HTTP handler lacks endpoint-level authorization, and the internal server-side Client() object bypasses the RBAC enforcement layer by querying SqlZenStore directly, making tenant isolation ineffective. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the low attack complexity and cross-tenant data exposure make this a meaningful risk in ZenML Pro/Cloud multi-tenant deployments.
Technical ContextAI
ZenML is an MLOps orchestration framework that manages machine learning pipelines, stacks, and cloud infrastructure connectors. The affected endpoint GET /api/v1/stack-deployment/stack (handler get_deployed_stack) is served by src/zenml/zen_server/routers/stack_deployment_endpoints.py. The authorization failure (CWE-862: Missing Authorization) manifests because the handler constructs a server-side Client() instance that communicates directly with SqlZenStore, circumventing the RBAC middleware that normally enforces per-resource read permissions. The fix in commit 9ad2c65f introduces batch_verify_permissions_for_models() to check read permissions on both the stack and any attached service connector before returning data, and wraps the response with dehydrate_response_model() to strip fields the caller lacks rights to see. The CPE cpe:2.3:a:zenml-io:zenml-io/zenml:*:*:*:*:*:*:*:* covers all versions; the confirmed vulnerable version is 0.94.2.
RemediationAI
Apply the upstream fix available in commit 9ad2c65f24ded22a5a98d289d63a7f629b434b61 (https://github.com/zenml-io/zenml/commit/9ad2c65f24ded22a5a98d289d63a7f629b434b61); a specific patched release version was not independently confirmed in available references, so monitor the ZenML changelog for the release incorporating this commit. As a compensating control for multi-tenant ZenML Pro/Cloud deployments where patching is not immediately possible, restrict network access to the GET /api/v1/stack-deployment/stack endpoint at the API gateway or reverse proxy layer to limit callers to explicitly authorized service accounts or administrators - this trades off deployment automation functionality that relies on the endpoint. Audit existing ZenML user accounts to ensure no unexpected authenticated principals exist, as any valid credential can currently exploit this flaw. Consult the huntr.com advisory (https://huntr.com/bounties/3b434e02-0ee9-4b5e-a44b-0988b6f074c7) for vendor guidance.
More in Zenml Io Zenml
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today