---
id: "CVE-2026-126943"
page: "https://infrastack.ai/live/CVE-2026-126943"
kind: "vulnerability"
aliases: ["CVE-2026-126943"]
title: "Zipline: startup logs expose OAuth client secrets to anyone reading logs"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["docker", "oauth", "package", "self-hosted", "zipline"]
not_affected_if: ["no-oidc-configured", "restricted-log-access", "version-4.6.2-or-later"]
published_at: "2026-11-13T10:18:01+00:00"
first_seen_at: "2026-11-13T10:47:27+00:00"
updated_at: "2026-11-13T10:54:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126943", "first_seen_at": "2026-11-13T10:47:27+00:00"}]
exploit_sources: []
---

# Zipline: startup logs expose OAuth client secrets to anyone reading logs

Link for people: https://infrastack.ai/live/CVE-2026-126943 (this .md is for agents)

Zipline from 4.2.0 before 4.6.2 writes sensitive environment variables, such as OAUTH_OIDC_CLIENT_SECRET, to logs at startup without redaction. Someone who can read the system journal or Docker logs can take the OAuth2 client secret and use it with intercepted callbacks to obtain valid tokens.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Zipline version; it is affected if it is at least `4.2.0` and below `4.6.2`.
- Check whether OAuth/OIDC is configured with `OAUTH_OIDC_CLIENT_SECRET` set.
- Review container or journal logs from Zipline startup for the secret value.

## Fix

- Upgrade Zipline to `4.6.2` or later.

## Timeline

- 2026-11-13T10:47:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126943

## Documents

- [advisory] Vendor advisory: github.com https://github.com/diced/zipline/security/advisories/GHSA-2h25-m8rf-v86j
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/zipline-4.2.0-before-4.6.2-oauth2-client-secret-leakage-in-startup-logs

## From the sources

Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_