Every CVE Search/ Get API key

CVE-2024-2032

Race Condition Vulnerability in zenml-io/zenml

3.1 LowFix available

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.29%Up 0.2 points since Jun 7, 2024
90%50%10%1%

What each source reports

CVE List Score used 3.1

Race Condition Vulnerability in zenml-io/zenml

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Record
CVE-2024-2032
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-366
Updated
2026-11-02
EUVDEUVD-2024-0193 3.1

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Record
EUVD-2024-0193
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-c546-8jmq-hprj 3.1

Race condition in zenml

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Record
GHSA-c546-8jmq-hprj
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-362, CWE-366
Updated
2026-11-02
NVD 3.1

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Record
CVE-2024-2032
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-366, CWE-362
Updated
2026-11-02
OSV 3.1

Race Condition Vulnerability in zenml-io/zenml

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Record
CVE-2024-2032
CVSS 3.0
3.1 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-366
Updated
2026-11-02
OSVGHSA-c546-8jmq-hprj 3.1

Race condition in zenml

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Record
GHSA-c546-8jmq-hprj
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Weakness
CWE-362, CWE-366
Updated
2026-11-02
OSVPYSEC-2024-105 3.1

A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.

Record
PYSEC-2024-105
CVSS 3.1
3.1 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
zenml
PyPI
before 0.55.5
0.55.5
zenml
PyPI
before 0.55.5, plus listed versions
0.0.1rc10.0.1rc20.1.00.1.10.1.2
Show 45 moreShow less
0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2
0.55.5
zenml
PyPI
before 0.55.5, plus listed versions
0.0.1rc10.0.1rc20.1.00.1.10.1.2
Show 45 moreShow less
0.1.30.1.3rc00.1.40.1.50.10.00.11.00.12.00.13.00.13.10.13.20.2.00.2.0rc10.2.0rc20.20.00.20.0rc10.20.10.20.20.20.30.20.40.20.50.21.00.21.10.22.00.23.00.3.10.3.1rc00.3.20.3.30.3.3rc00.3.40.3.4rc00.3.50.3.5rc00.3.60.3.6.10.3.6rc00.3.70.3.7.1rc00.3.7.1rc10.3.7.1rc30.3.7.1rc40.3.7rc00.3.80.3.9rc10.3.9rc2
0.55.5

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-2032 is a low vulnerability (CVSS 3.1) in Zenml, published June 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in zenml 0.55.5.

References

This page doesn't list everything

Left out here: 159 versions. The JSON record has them.

MoveEnter Open