{"id":"CVE-2026-126943","kind":"vulnerability","aliases":["CVE-2026-126943"],"related":[],"title":"Zipline: startup logs expose OAuth client secrets to anyone reading logs","description":"Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.","summary":"Zipline from 4.2.0 before 4.6.2 writes sensitive environment variables, such as OAUTH_OIDC_CLIENT_SECRET, to logs at startup without redaction. Someone who can read the system journal or Docker logs can take the OAuth2 client secret and use it with intercepted callbacks to obtain valid tokens.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["docker","oauth","package","self-hosted","zipline"],"not_affected_if":["no-oidc-configured","restricted-log-access","version-4.6.2-or-later"],"how_to_check":"- Check the installed Zipline version; it is affected if it is at least `4.2.0` and below `4.6.2`.\n- Check whether OAuth/OIDC is configured with `OAUTH_OIDC_CLIENT_SECRET` set.\n- Review container or journal logs from Zipline startup for the secret value.","fix":"- Upgrade Zipline to `4.6.2` or later.","status":"open","published_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","triaged_at":"2026-11-13T10:54:41+00:00","updated_at":"2026-11-13T10:54:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:54:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Zipline to `4.6.2` or later.","reach":"local","title":"Zipline: startup logs expose OAuth client secrets to anyone reading logs","impact":"medium","summary":"Zipline from 4.2.0 before 4.6.2 writes sensitive environment variables, such as OAUTH_OIDC_CLIENT_SECRET, to logs at startup without redaction. Someone who can read the system journal or Docker logs can take the OAuth2 client secret and use it with intercepted callbacks to obtain valid tokens.","audience":"businesses","category":"package","nicknames":[],"who_cares":["zipline","self-hosted","docker","oauth"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"OAuth client secret readable from logs, enabling token theft","analyst_note":"Product name and ecosystem are listed; confirm the fix version in the vendor advisory linked from GitHub.','product_name':'', 'product_ecosystem':''}.Replace","how_to_check":"- Check the installed Zipline version; it is affected if it is at least `4.2.0` and below `4.6.2`.\n- Check whether OAuth/OIDC is configured with `OAUTH_OIDC_CLIENT_SECRET` set.\n- Review container or journal logs from Zipline startup for the secret value.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-4.6.2-or-later","no-oidc-configured","restricted-log-access"],"who_is_affected":"Teams running self-hosted Zipline from 4.2.0 up to but not including 4.6.2 that use OAuth/OIDC login. Exposure depends on who can read the host's journal or Docker logs; deployments without OIDC configured do not hold the affected secret.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000795,"input_tokens":4633,"output_tokens":664,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126943':14A,17A '-2026':13A,16A '4.2.0':27B,74C '4.6.2':29B,76C 'access':100C 'anyon':9A 'attack':98C 'callback':67B,119C 'client':6A,38B,60B,92C,110C 'contain':77C 'cve':12A,15A 'disclosur':80C 'docker':18B,54B,105C 'environ':32B,85C 'exchang':116C 'expos':4A 'host':23B 'inform':79C 'intercept':66B,117C 'journal':52B,103C 'log':3A,11A,41B,55B,83C,106C 'oauth':5A,19B,36B,90C 'oauth2':59B,109C,118C 'obtain':69B,108C 'oidc':37B,91C 'packag':20B 'read':10A,49B 'redact':45B,95C 'secret':7A,39B,61B,93C,111C 'self':22B 'self-host':21B 'sensit':31B,84C 'someon':46B 'startup':2A,43B,97C 'system':51B,102C 'take':57B 'token':71B,122C 'use':63B,113C 'valid':70B,121C 'valu':87C 'variabl':33B,86C 'vulner':81C 'without':44B,94C 'write':30B 'ziplin':1A,24B,25B,72C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Zipline from 4.2.0 up to but not including 4.6.2 that use OAuth/OIDC login. Exposure depends on who can read the host's journal or Docker logs; deployments without OIDC configured do not hold the affected secret.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["docker","medium","oauth","package","selfhosted","zipline"],"campaign_type":null,"search_a":"'-126943':14A,17A '-2026':13A,16A 'anyon':9A 'client':6A 'cve':12A,15A 'expos':4A 'log':3A,11A 'oauth':5A 'read':10A 'secret':7A 'startup':2A 'ziplin':1A","search_b":"'4.2.0':27B '4.6.2':29B 'callback':67B 'client':38B,60B 'docker':18B,54B 'environ':32B 'host':23B 'intercept':66B 'journal':52B 'log':41B,55B 'oauth':19B,36B 'oauth2':59B 'obtain':69B 'oidc':37B 'packag':20B 'read':49B 'redact':45B 'secret':39B,61B 'self':22B 'self-host':21B 'sensit':31B 'someon':46B 'startup':43B 'system':51B 'take':57B 'token':71B 'use':63B 'valid':70B 'variabl':33B 'without':44B 'write':30B 'ziplin':24B,25B","search_c":"'4.2.0':74C '4.6.2':76C 'access':100C 'attack':98C 'callback':119C 'client':92C,110C 'contain':77C 'disclosur':80C 'docker':105C 'environ':85C 'exchang':116C 'inform':79C 'intercept':117C 'journal':103C 'log':83C,106C 'oauth':90C 'oauth2':109C,118C 'obtain':108C 'oidc':91C 'redact':95C 'secret':93C,111C 'sensit':84C 'startup':97C 'system':102C 'token':122C 'use':113C 'valid':121C 'valu':87C 'variabl':86C 'vulner':81C 'without':94C 'ziplin':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-06-03T02:40:25+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126943","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126943","severity":null,"published_at":"2026-11-13T10:18:01+00:00","modified_at":"2026-11-13T10:18:01+00:00","first_seen_at":"2026-11-13T10:47:27+00:00","fetched_at":"2026-11-13T10:47:27+00:00","note":null}],"documents":[{"id":145247,"url":"https://github.com/diced/zipline/security/advisories/GHSA-2h25-m8rf-v86j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-06-03T02:40:25+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145248,"url":"https://www.vulncheck.com/advisories/zipline-4.2.0-before-4.6.2-oauth2-client-secret-leakage-in-startup-logs","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}