CVE-2026-126943
Last modified
CVE-2026-126943 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens..
Description
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| diced | zipline | >= 4.2.0, < 4.6.2 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-126943?
How severe is CVE-2026-126943?
How do I fix CVE-2026-126943?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-126938Zipline before 4.6.4 contains a resource allocation vulnerab…7.1
- CVE-2026-126939Zipline before 4.6.4 contains an information disclosure vuln…5.3
- CVE-2026-12694Missing Authorization vulnerability in Vimesoft Inc. Enterpr…9.1
- CVE-2026-126940Zipline before 4.6.4 contains a rate limit bypass vulnerabil…6.5
- CVE-2026-126941Zipline through 4.6.2 contains an authorization bypass vulne…6.8
- CVE-2026-126942Zipline before 4.6.2 contains a missing authorization vulner…5.4
- CVE-2026-126944Zipline before 4.6.1 contains a path traversal vulnerability…5.7
- CVE-2026-126945Zipline before 4.5.1 contains a stored cross-site scripting …8.7
- CVE-2026-126946Zipline from 4.3.0 before 4.5.0 contains a stored cross-site…5.4
- CVE-2026-126947Zipline before 4.5.0 contains a stored open redirect vulnera…5.4
- CVE-2026-126948Zipline before 4.5.0 contains an insecure direct object refe…8.8
- CVE-2026-126949Zipline through 4.4.0 contains a path traversal vulnerabilit…7
Are you affected by CVE-2026-126943?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST