Zenml Io Zenml
Monthly
Rate-limiting on ZenML's login and self-password-change endpoints can be completely bypassed in versions 0.57.0 through 0.94.2 by rotating the client-supplied `X-Forwarded-For` header, enabling unthrottled brute-force credential guessing against any exposed ZenML server. The rate limiter in `rate_limit.py` keyed on the raw `X-Forwarded-For` header value rather than the verified peer address, a design that is exploitable whenever Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *` - which was the Helm chart default. No active exploitation is confirmed in CISA KEV; an upstream fix commit is available but a released patched version is not independently confirmed from available data.
Missing RBAC authorization on the ZenML 0.94.2 `get_deployed_stack` endpoint allows any authenticated user to enumerate all deployed stacks across all users and tenants. The root failure is twofold: the HTTP handler lacks endpoint-level authorization, and the internal server-side `Client()` object bypasses the RBAC enforcement layer by querying `SqlZenStore` directly, making tenant isolation ineffective. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the low attack complexity and cross-tenant data exposure make this a meaningful risk in ZenML Pro/Cloud multi-tenant deployments.
Rate-limiting on ZenML's login and self-password-change endpoints can be completely bypassed in versions 0.57.0 through 0.94.2 by rotating the client-supplied `X-Forwarded-For` header, enabling unthrottled brute-force credential guessing against any exposed ZenML server. The rate limiter in `rate_limit.py` keyed on the raw `X-Forwarded-For` header value rather than the verified peer address, a design that is exploitable whenever Uvicorn is launched with `--proxy-headers --forwarded-allow-ips *` - which was the Helm chart default. No active exploitation is confirmed in CISA KEV; an upstream fix commit is available but a released patched version is not independently confirmed from available data.
Missing RBAC authorization on the ZenML 0.94.2 `get_deployed_stack` endpoint allows any authenticated user to enumerate all deployed stacks across all users and tenants. The root failure is twofold: the HTTP handler lacks endpoint-level authorization, and the internal server-side `Client()` object bypasses the RBAC enforcement layer by querying `SqlZenStore` directly, making tenant isolation ineffective. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, but the low attack complexity and cross-tenant data exposure make this a meaningful risk in ZenML Pro/Cloud multi-tenant deployments.