Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
zenml-io/zenml
main @ d4bc9bc
92
Fixes
14
CVEs
CRITICAL
Peak severity
35.3%
Coverage
Highlights
Auth Bypass: 50 prior fixes. Scrutinize any change in this area.
src/zenml/zen_server/auth.py: most-fixed (11 issues). Treat as high-risk during review.
53 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The authentication engine has suffered from critical flaws, including completely bypassing validation when no credentials were supplied, weak truthiness checks for empty API keys, and validation tracking bugs for long-running pipeline workload tokens.
Path Traversal: Tar extraction operations in the materializer stack previously allowed path traversal. Attackers could craft archives containing symbolic or hard links targeting directories outside the intended destination, resulting in arbitrary file writes (CVE-2025-8406).
Auth Bypass: Role-Based Access Control checks were routinely bypassed during the serialization of paginated nested resources and the lazy-loading of response models due to insufficient dehydration and scope propagation logic.