CVE-2026-11876: ZenML Information Disclosure Vulnerability

CVE-2026-11876 Overview

CVE-2026-11876 is a missing authorization vulnerability in zenml-io/zenml version 0.94.2. The GET /api/v1/stack-deployment/stack endpoint, backed by the get_deployed_stack handler, does not enforce Role-Based Access Control (RBAC). Any authenticated user can enumerate every deployed stack across all users and tenants. The exposed data includes stack component configurations, service connector information, and the user IDs of stack owners. In multi-tenant ZenML Pro and ZenML Cloud deployments, this enables cross-tenant reconnaissance of infrastructure topology and deployment metadata.

Critical Impact
Authenticated users can enumerate deployed stacks, service connectors, and owner identifiers across tenant boundaries, exposing infrastructure topology in multi-tenant ZenML deployments.

Affected Products

zenml-io/zenml version 0.94.2
ZenML Pro multi-tenant deployments
ZenML Cloud deployments

Discovery Timeline

2026-07-21 - CVE-2026-11876 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-11876

Vulnerability Analysis

The flaw is a Missing Authorization weakness classified under [CWE-862]. It resides in src/zenml/zen_server/routers/stack_deployment_endpoints.py within the get_deployed_stack function. The endpoint returns deployed stack objects containing infrastructure topology, service connector details, stack ownership metadata, and deployment attributes. Because RBAC checks are absent, authorization is not evaluated against the requesting principal before the response is assembled. Any user holding a valid session token can retrieve records that belong to other tenants.

Root Cause

Two defects combine to produce the exposure. First, the endpoint handler omits endpoint-level RBAC decorators or explicit permission checks. Second, the handler uses a server-side Client() object that accesses SqlZenStore directly. This code path bypasses the RBAC enforcement layer that normally filters resources by ownership and tenant. The result is unfiltered database access returned through an authenticated but unauthorized API.

Attack Vector

An attacker only needs a valid authenticated session in the ZenML server, which corresponds to the CVSS PR:L requirement. The request is issued over the network against the /api/v1/stack-deployment/stack route. No user interaction is required, and the scope changes because data belonging to other tenants is disclosed to the calling principal. Confidentiality of infrastructure metadata is impacted; integrity and availability are not.

python

 """Endpoint definitions for stack deployments."""
 
 import datetime
-from typing import Optional
+from typing import List, Optional
 
 from fastapi import APIRouter, Request, Security
+from pydantic import BaseModel
 
 from zenml.constants import (
     API,

Source: GitHub commit 9ad2c65 — the patch introduces authorization checks and response models to the stack deployment endpoint.

Detection Methods for CVE-2026-11876

Indicators of Compromise

Repeated authenticated GET requests to /api/v1/stack-deployment/stack from a single principal in a short window.
Requests to the endpoint from user accounts that have never previously interacted with stack deployment workflows.
Response payloads containing stack owner user IDs that do not match the caller's tenant or workspace.

Detection Strategies

Enable access logging on the ZenML API gateway and alert on calls to get_deployed_stack from non-administrative roles.
Compare the user_id field in each response against the authenticated caller's tenant membership to identify cross-tenant reads.
Baseline typical query rates for the endpoint and flag statistical outliers indicative of enumeration.

Monitoring Recommendations

Ingest ZenML server access logs into a centralized SIEM or data lake for retention and correlation.
Track service connector read events alongside API calls to detect follow-on reconnaissance.
Monitor for unusual outbound activity from cloud service accounts referenced in exposed service connector metadata.

How to Mitigate CVE-2026-11876

Immediate Actions Required

Upgrade ZenML servers to the release containing commit 9ad2c65f24ded22a5a98d289d63a7f629b434b61 or later.
Audit access logs for prior calls to /api/v1/stack-deployment/stack and identify any cross-tenant enumeration.
Rotate credentials referenced by service connectors that may have been enumerated through the endpoint.

Patch Information

The upstream fix is published in the zenml-io/zenml patch commit, which adds authorization checks to the stack deployment endpoint (#4917). Additional context is available in the Huntr bounty listing.

Workarounds

Restrict network access to the /api/v1/stack-deployment/stack route using a reverse proxy or API gateway ACL until the patch is applied.
Limit ZenML server accounts to trusted operators in multi-tenant deployments while the fix is rolled out.
Review and minimize the sensitivity of data stored in stack component and service connector definitions.

bash

# Example gateway rule to block the vulnerable endpoint pre-patch (NGINX)
location = /api/v1/stack-deployment/stack {
    deny all;
    return 403;
}