{"id":"CVE-2026-126937","kind":"vulnerability","aliases":["CVE-2026-126937"],"related":[],"title":"Zipline: setup race lets unauthenticated attackers create superadmin accounts","description":"Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance.","summary":"Zipline before 4.6.5 has a race condition in its POST /api/setup endpoint that lets unauthenticated attackers create multiple SUPERADMIN accounts by sending concurrent requests before the first-setup flag resets. A successful attacker gains full administrative control of the Zipline instance.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Zipline","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["docker","package","self-hosted","zipline"],"not_affected_if":["fixed-version","setup-completed"],"how_to_check":"- Check the Zipline version running on the instance; versions before `4.6.5` are in the stated range.\n- Look for unexpected SUPERADMIN accounts in the user list of the Zipline instance.\n- Check whether the instance's `/api/setup` endpoint is reachable from the internet.","fix":"- Zipline: move to `4.6.5` or later.","status":"open","published_at":"2026-11-13T10:18:00+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:48:33+00:00","updated_at":"2026-11-13T10:48:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-13T10:48:33Z","model":"claude-haiku-5-5","output":{"fix":"- Zipline: move to `4.6.5` or later.","reach":"internet","title":"Zipline: setup race lets unauthenticated attackers create superadmin accounts","impact":"high","summary":"Zipline before 4.6.5 has a race condition in its POST /api/setup endpoint that lets unauthenticated attackers create multiple SUPERADMIN accounts by sending concurrent requests before the first-setup flag resets. A successful attacker gains full administrative control of the Zipline instance.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted","docker"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Attacker gains full administrative control of the instance","analyst_note":"Confirm the affected window: whether exposure requires the setup flow to be unfinished, and check vendor advisory on github.com and the VulnCheck advisory for exact fixed-version wording.","how_to_check":"- Check the Zipline version running on the instance; versions before `4.6.5` are in the stated range.\n- Look for unexpected SUPERADMIN accounts in the user list of the Zipline instance.\n- Check whether the instance's `/api/setup` endpoint is reachable from the internet.","plain_action":"","product_name":"Zipline","needs_analyst":true,"not_affected_if":["fixed-version","setup-completed"],"who_is_affected":"Self-hosted Zipline instances running a version before 4.6.5 that are reachable by an attacker before the initial setup is completed. Instances already set up and running a fixed version are not exposed through this path. Teams using a managed Zipline host should confirm the provider's version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000781,"input_tokens":4641,"output_tokens":633,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-126937':12A,15A '-2026':11A,14A '/api/setup':33B,76C '4.6.5':25B,67C 'account':9A,42B,86C 'administr':59B,117C 'allow':79C 'argon2':111C 'attack':6A,38B,56B,81C,97C 'concurr':45B,89C 'condit':29B,72C 'contain':68C 'control':60B,118C 'creat':7A,39B,83C 'cve':10A,13A 'docker':17B 'endpoint':34B,77C 'first':50B 'first-setup':49B 'firstsetup':93C 'flag':52B,94C 'forward':106C 'full':58B,116C 'gain':57B,115C 'hash':112C 'header':108C 'host':21B 'instanc':64B,121C 'let':4A,36B 'multipl':40B,84C 'packag':18B 'post':32B,75C 'race':3A,28B,71C,88C 'request':46B,90C,101C 'reset':53B,96C 'self':20B 'self-host':19B 'send':44B,99C 'setup':2A,51B 'simultan':100C 'spoof':103C 'success':55B 'superadmin':8A,41B,85C 'toctou':70C 'unauthent':5A,37B,80C 'window':113C 'x':105C 'x-forwarded-for':104C 'ziplin':1A,22B,23B,63B,65C 'zipline':16A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Zipline instances running a version before 4.6.5 that are reachable by an attacker before the initial setup is completed. Instances already set up and running a fixed version are not exposed through this path. Teams using a managed Zipline host should confirm the provider's version.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["zipline"],"ptokens":["zipline"],"labels":["critical","docker","package","selfhosted","vendor","zipline"],"campaign_type":null,"search_a":"'-126937':12A,15A '-2026':11A,14A 'account':9A 'attack':6A 'creat':7A 'cve':10A,13A 'let':4A 'race':3A 'setup':2A 'superadmin':8A 'unauthent':5A 'ziplin':1A 'zipline':16A","search_b":"'/api/setup':33B '4.6.5':25B 'account':42B 'administr':59B 'attack':38B,56B 'concurr':45B 'condit':29B 'control':60B 'creat':39B 'docker':17B 'endpoint':34B 'first':50B 'first-setup':49B 'flag':52B 'full':58B 'gain':57B 'host':21B 'instanc':64B 'let':36B 'multipl':40B 'packag':18B 'post':32B 'race':28B 'request':46B 'reset':53B 'self':20B 'self-host':19B 'send':44B 'setup':51B 'success':55B 'superadmin':41B 'unauthent':37B 'ziplin':22B,23B,63B","search_c":"'/api/setup':76C '4.6.5':67C 'account':86C 'administr':117C 'allow':79C 'argon2':111C 'attack':81C,97C 'concurr':89C 'condit':72C 'contain':68C 'control':118C 'creat':83C 'endpoint':77C 'firstsetup':93C 'flag':94C 'forward':106C 'full':116C 'gain':115C 'hash':112C 'header':108C 'instanc':121C 'multipl':84C 'post':75C 'race':71C,88C 'request':90C,101C 'reset':96C 'send':99C 'simultan':100C 'spoof':103C 'superadmin':85C 'toctou':70C 'unauthent':80C 'window':113C 'x':105C 'x-forwarded-for':104C 'ziplin':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-28T22:35:54+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126937","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126937","severity":null,"published_at":"2026-11-13T10:18:00+00:00","modified_at":"2026-11-13T10:18:00+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145235,"url":"https://github.com/diced/zipline/security/advisories/GHSA-wgjv-p9mm-qw77","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-28T22:35:54+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145236,"url":"https://www.vulncheck.com/advisories/zipline-before-4.6.5-toctou-race-condition-via-api-setup","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}