CVE-2026-126943 · Package
NO FIX YET · SEE WHAT TO DO
Zipline from 4.2.0 before 4.6.2 writes sensitive environment variables, such as OAUTH_OIDC_CLIENT_SECRET, to logs at startup without redaction. Someone who can read the system journal or Docker logs can take the OAuth2 client secret and use it with intercepted callbacks to obtain valid tokens.
first public Jun 3, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running self-hosted Zipline from 4.2.0 up to but not including 4.6.2 that use OAuth/OIDC login. Exposure depends on who can read the host's journal or Docker logs; deployments without OIDC configured do not hold the affected secret.
Not affected if no-oidc-configured, restricted-log-access, version-4.6.2-or-later
Who cares docker, oauth, self-hosted, zipline
4.2.0 and below 4.6.2.OAUTH_OIDC_CLIENT_SECRET set.4.6.2 or later.Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.