{"cve":"CVE-2024-2032","nvd":{"published":"2024-06-06T19:15:53.060","modified":"2026-06-17T07:23:35.890","status":"Modified","description":"A race condition vulnerability exists in zenml-io/zenml versions up to and including 0.55.3, which allows for the creation of multiple users with the same username when requests are sent in parallel. This issue was fixed in version 0.55.5. The vulnerability arises due to insufficient handling of concurrent user creation requests, leading to data inconsistencies and potential authentication problems. Specifically, concurrent processes may overwrite or corrupt user data, complicating user identification and posing security risks. This issue is particularly concerning for APIs that rely on usernames as input parameters, such as PUT /api/v1/users/test_race, where it could lead to further complications.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L","score":3.1},"cwes":["CWE-362","CWE-366"],"references":["https://github.com/zenml-io/zenml/commit/afcaf741ef9114c9b32f722f101b97de3d8d147b","https://huntr.com/bounties/6199cd5d-611f-4ea9-96c5-52a952ba5a56","https://github.com/zenml-io/zenml/commit/afcaf741ef9114c9b32f722f101b97de3d8d147b","https://huntr.com/bounties/6199cd5d-611f-4ea9-96c5-52a952ba5a56"],"products":["zenml:zenml"],"source":"nvd","synced_at":"2026-10-19T21:51:20.603330631+00:00"},"epss":{"cve":"CVE-2024-2032","score":0.00291,"percentile":0.21694,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-c546-8jmq-hprj","url":"https://osv.dev/vulnerability/GHSA-c546-8jmq-hprj","summary":"Race condition in zenml","modified":"2024-10-14T18:53:17.758464Z","packages":[{"ecosystem":"PyPI","name":"zenml","purl":"pkg:pypi/zenml","ranges":["<0.55.5"],"fixed":["0.55.5"]}]},{"id":"PYSEC-2024-105","url":"https://osv.dev/vulnerability/PYSEC-2024-105","summary":"","modified":"2026-06-10T17:02:51.328639373Z","packages":[{"ecosystem":"PyPI","name":"zenml","purl":"pkg:pypi/zenml","ranges":["<0.55.5"],"fixed":["0.55.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}