Vulnerability Description
In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenants. This includes stack component details, service connector information, and user IDs of stack owners. The vulnerability arises from two issues: missing endpoint-level RBAC checks and the use of a server-side `Client()` that bypasses the RBAC enforcement layer by directly accessing the database through `SqlZenStore`. This exposes sensitive information such as infrastructure topology, service connector details, stack ownership, and deployment metadata, potentially enabling cross-tenant reconnaissance and further attacks in multi-tenant ZenML Pro/Cloud deployments.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/zenml-io/zenml/commit/9ad2c65f24ded22a5a98d289d63a7f629b434b6
- https://huntr.com/bounties/3b434e02-0ee9-4b5e-a44b-0988b6f074c7
- https://huntr.com/bounties/3b434e02-0ee9-4b5e-a44b-0988b6f074c7
FAQ
What is CVE-2026-11876?
CVE-2026-11876 is a vulnerability with a CVSS score of 5.0 (MEDIUM). In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all depl...
How severe is CVE-2026-11876?
CVE-2026-11876 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-11876?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.