AIKIDO-2025-10462
zenml is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
30
Low Risk
This Affects:
zenmlTL;DR
Affected versions of this package are vulnerable to Improper Access Control on Service Connector Secrets, where ZenML stored service connector credentials as standard secrets visible via the API. This allowed unauthorized users to list, retrieve, or modify these secrets, potentially exposing sensitive credentials (e.g., cloud keys) and enabling theft, privilege escalation, or service disruption. Attackers could exploit this by querying the secrets API to access protected resources impersonating the connector, compromising linked infrastructure.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
zenml is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in versions 0.40.0 - 0.83.1.
How to fix this
Upgrade the zenml library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant