CVE-2026-126943: Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTHOIDCCLIENTSECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to the system journal or Docker logs containing Zipline startup output. The disclosed OAuth2 client secret can then be used with intercepted OAuth2 callbacks to exchange them for valid tokens.
Which deployments are affected?
Zipline versions from 4.2.0 before 4.6.2 are affected when sensitive environment variables such as OAUTH_OIDC_CLIENT_SECRET are logged at startup. Deployments without access controls on journal or Docker logs present exposure to anyone who can read those logs.
What can be done before upgrading?
Restrict access to system journal and Docker logs, and treat any OAuth2 client secret written to startup logs as exposed. Rotate the affected OAuth2 client secret and prevent further retention or access to the startup log entries.