CVE-2026-126943
MEDIUM
NVD
CVSS Score
4.9
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens.