CVE-2024-25723: ZenML Server Privilege Escalation Flaw

CVE-2024-25723 Overview

CVE-2024-25723 is a remote privilege escalation vulnerability in ZenML Server, a component of the ZenML machine learning package for Python. The flaw resides in the /api/v1/users/{user_name_or_id}/activate REST API endpoint, which grants access based solely on a valid username paired with a new password supplied in the request body. An authenticated attacker with low privileges can reset the credentials of any known user, including administrators, and take over their account. The vulnerability affects ZenML versions before 0.46.7, with patched releases available in 0.46.7, 0.44.4, 0.43.1, and 0.42.2. The issue is tracked under CWE-284 (Improper Access Control).

Critical Impact
An attacker who knows or can enumerate a target username can reset the account password through the activation endpoint, gaining full administrative control of the ZenML Server and any connected ML pipelines, artifacts, and credentials.

Affected Products

ZenML Python package versions prior to 0.46.7
ZenML 0.43.0 (fixed in 0.43.1)
ZenML 0.42.x (fixed in 0.42.2) and 0.44.x (fixed in 0.44.4)

Discovery Timeline

2024-02-27 - CVE-2024-25723 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25723

Vulnerability Analysis

ZenML Server exposes a REST API endpoint at /api/v1/users/{user_name_or_id}/activate intended for first-time user activation. The endpoint accepts a username or user identifier in the URL path and a new password in the JSON request body. It then activates the account and updates the credentials.

The endpoint does not verify whether the target user account is in an unactivated state or whether the caller is authorized to modify that specific user. As a result, the activation flow doubles as an unauthenticated password reset for any known user, including the default admin account.

An attacker who reaches the ZenML Server over the network and submits a request with a valid username can overwrite that user's password. Once the password is replaced, the attacker authenticates as the victim and inherits all of their permissions, including administrative control over ML pipelines, stacks, secrets, and connected cloud resources.

Root Cause

The root cause is improper access control [CWE-284] on the user activation route. The handler treats knowledge of a username as sufficient authorization to set a new password, and does not enforce state checks or caller identity verification against the target user.

Attack Vector

Exploitation requires network reachability to the ZenML Server API and knowledge of a target username. Default administrative accounts and predictable usernames make enumeration straightforward. The attacker sends a crafted HTTP request to the activation endpoint with the target username in the path and a chosen password in the body, then logs in with the new credentials. No user interaction and no prior valid session on the target account are required. See the ZenML security advisory and the patch diff for 0.44.4 for technical details on the fix.

Detection Methods for CVE-2024-25723

Indicators of Compromise

HTTP POST or PUT requests to /api/v1/users/{user_name_or_id}/activate from unexpected source IPs or user agents.
Successful logins immediately following an activation request against a previously active account, particularly for admin users.
Unexpected password change events in ZenML Server audit logs for accounts that were not undergoing onboarding.
Creation of new stacks, secrets, or pipelines shortly after an anomalous activation request.

Detection Strategies

Parse ZenML Server access logs for any request path matching /api/v1/users/*/activate and correlate with the responding HTTP status code and source IP.
Alert when an activation request targets a user account whose creation timestamp is older than the onboarding window used in your environment.
Baseline normal activation traffic in staging and production, and flag deviations such as multiple activations from a single client.

Monitoring Recommendations

Forward ZenML Server and reverse-proxy logs to a centralized logging or SIEM platform and retain them for post-incident review.
Monitor authentication events for administrative users and alert on password changes performed outside of approved identity workflows.
Track outbound API calls from the ZenML Server to cloud providers for signs of credential abuse following a suspected takeover.

How to Mitigate CVE-2024-25723

Immediate Actions Required

Upgrade ZenML to a patched release: 0.46.7 or later, or the branch-specific fixes 0.44.4, 0.43.1, or 0.42.2.
Restrict network access to the ZenML Server so that only trusted clients and CI/CD systems can reach the REST API.
Rotate all ZenML user passwords and any secrets, cloud credentials, or tokens stored in ZenML stacks after upgrading.
Review audit logs for prior invocations of the /api/v1/users/{user_name_or_id}/activate endpoint and investigate any unexpected activity.

Patch Information

ZenML addressed the vulnerability in versions 0.46.7, 0.44.4, 0.43.1, and 0.42.2. The vendor published guidance in the ZenML critical security update blog post. Patch diffs are available for the 0.42.2 fix, the 0.43.1 fix, and the 0.44.4 fix. Source is maintained in the ZenML GitHub repository.

Workarounds

If immediate upgrade is not possible, place the ZenML Server behind an authenticating reverse proxy or VPN and block external access to /api/v1/users/*/activate.
Disable or remove unused user accounts, especially default administrator accounts, to reduce the attack surface for username enumeration.
Enforce network-layer allowlists so that only known engineering hosts can reach the ZenML API until the patched version is deployed.

bash

# Configuration example: upgrade ZenML to a patched release
pip install --upgrade "zenml>=0.46.7"

# Verify installed version
zenml version

# Example nginx snippet to block the vulnerable endpoint until patched
# location ~* ^/api/v1/users/.+/activate$ {
#     deny all;
#     return 403;
# }