ZIPLINE · CVE-2026-126937 · Package
NO FIX YET · SEE WHAT TO DO
Zipline before 4.6.5 has a race condition in its POST /api/setup endpoint that lets unauthenticated attackers create multiple SUPERADMIN accounts by sending concurrent requests before the first-setup flag resets. A successful attacker gains full administrative control of the Zipline instance.
first public Jul 28, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted Zipline instances running a version before 4.6.5 that are reachable by an attacker before the initial setup is completed. Instances already set up and running a fixed version are not exposed through this path. Teams using a managed Zipline host should confirm the provider's version.
Not affected if fixed-version, setup-completed
Who cares docker, self-hosted, zipline
4.6.5 are in the stated range./api/setup endpoint is reachable from the internet.4.6.5 or later.Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.