CVE-2026-126934— Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Quick assessment

Affected

diced zipline

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Zipline 4.3.2 至 4.8.0 版本（不含 4.8.0）中存在一个速率限制绕过漏洞。当配置项启用时，未认证的攻击者可通过伪造请求头来规避速率限制（throttling）。攻击者可在每次请求中提交不同的值，从而获取全新的速率限制配额桶，进而实现对登录密码、一次性密码（TOTP）以及文件和 URL 密码的无限次暴力猜测。

CVSS 6.5 · Medium Updated Nov 12, 2026

Possible ATT&CK Techniques 3 AI

T1110 · Brute Force T1003 · OS Credential Dumping T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For

Source: CVE Program / CVE List V5

Vulnerability Description

Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per request to obtain fresh rate-limit buckets, enabling unlimited guessing of login passwords, TOTP codes, and file and URL passwords.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

使用不可信的源

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
diced	zipline	4.3.2 ~ 4.8.0	-

II. Public POCs for CVE-2026-126934

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126934

请登录查看更多情报信息。

Other References for CVE-2026-126934 (6)

https://github.com/diced/zipline/commit/6bac7e6bb18cb37c1d09f91306c1ffbdca00097c patch
https://github.com/diced/zipline/blob/v4.7.0/src/server/startup/plugins.ts#L70-L73 technical-description
https://github.com/diced/zipline/blob/v4.7.0/src/server/index.ts#L58-L62 technical-description
https://github.com/diced/zipline/releases/tag/v4.8.0 release-notes
https://github.com/diced/zipline/security/advisories/GHSA-v938-v8wg-9497 vendor-advisory
https://www.vulncheck.com/advisories/zipline-4.3.2-before-4.8.0-rate-limit-bypass-via-spoofed-x-forwarded-for third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126934

Same Patch Batch · diced · 2026-11-11 · 4 CVEs total

CVE-2026-126933	4.3 MEDIUM	Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format M
CVE-2026-126932	4.3 MEDIUM	Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update
CVE-2026-126935	3.7 LOW	Zipline before 4.8.0 maxViews Limit Bypass via Race Condition

IV. Related Vulnerabilities

Same product: zipline

Same vendor: diced

Same weakness: CWE-348