{"id":"CVE-2026-118624","kind":"vulnerability","aliases":["CVE-2026-118624"],"related":[],"title":"MLflow: logged-in users can read and cancel other users' jobs on the tracking server (basic-auth)","description":"MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894.","summary":"ZDI-26-840: the MLflow tracking server's job routes (GET /mlflow/jobs/<id>, PATCH /mlflow/jobs/cancel/<id>) had no authorization validator and jobs recorded no owner (_find_validator). Under the built-in basic-auth, any authenticated user could read another user's job parameters and results, and cancel it. ZDI states it is fixed in MLflow 3.16.0; the linked PR adds a per-job creator check.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.16.0"],"affected":"< 3.16.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","auth-required","mlflow","python","self-hosted"],"not_affected_if":["auth-required"],"how_to_check":"Run 'mlflow --version' (or pip show mlflow); versions before 3.16.0 are affected per ZDI. Check whether your tracking server runs with the built-in basic-auth app (mlflow server --app-name basic-auth) and whether anything submits jobs through the server's jobs API. Start of the affected range is not stated by ZDI (one aggregator lists 3.13.0, unconfirmed).","fix":"Upgrade MLflow to 3.16.0 (per ZDI-26-840). The fix adds a nullable jobs.creator column through a database migration and restricts job fetch/cancel to the creator; admins are exempt. Jobs created before the upgrade have no creator and are denied to non-admins.","status":"open","published_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:48:02+00:00","updated_at":"2026-11-04T00:49:37+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-04T00:48:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MLflow: missing authorization in tracking server jobs leaks sensitive information","impact":"low","summary":"MLflow's Tracking Server Jobs feature lacks an authorization check in its _find_validator function, so a logged-in user can reach functionality they should not. An attacker can read sensitive information in the context of the service account.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","self-hosted","python"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Sensitive information readable in the service account context","analyst_note":"Find the affected MLflow version range and the fixed version, and confirm whether the Jobs feature is required to be enabled; check the ZDI advisory for ZDI-CAN-31894.","how_to_check":"- Check whether the MLflow Tracking Server is running with Jobs enabled, using the server configuration (unknown for the exact setting name in the sources)\n- Check the installed MLflow version with `mlflow --version` (affected versions: unknown)","plain_action":"","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Teams running a self-hosted MLflow Tracking Server with the Jobs feature and user accounts are the likely exposure, since authentication is required to exploit it. Installations without Jobs or without multiple users are probably not exposed, though the sources do not state this explicitly.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4190,"output_tokens":547,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find the affected MLflow version range and the fixed version, and confirm whether the Jobs feature is required to be enabled; check the ZDI advisory for ZDI-CAN-31894.","search":"'-118624':22A,25A '-2026':21A,24A '-26':39B '-840':40B '/mlflow/jobs':49B '/mlflow/jobs/cancel':51B '3.16.0':93B '31894':177C 'access':154C 'account':172C 'add':97B 'affect':123C 'ai':28B 'ai-tool':27B 'allow':115C,153C 'anoth':76B 'attack':117C,158C 'auth':19A,31B,70B 'auth-requir':30B 'authent':72B,127C 'author':54B,109C,150C 'basic':18A,69B 'basic-auth':17A,68B 'built':66B 'built-in':65B 'cancel':9A,84B 'check':103B 'context':168C 'could':74B 'creator':102B 'cve':20A,23A 'disclos':119C,164C 'disclosur':111C 'exist':137C 'exploit':131C 'find':61B,140C 'fix':90B 'flaw':136C 'function':142C,156C 'get':48B 'host':37B 'inform':110C,121C,165C 'instal':124C 'issu':144C 'job':12A,46B,57B,79B,101B,107C 'lack':148C 'leverag':160C 'link':95B 'log':3A 'logged-in':2A 'miss':108C 'mlflow':1A,26A,33B,42B,92B,104C,126C 'owner':60B 'paramet':80B 'patch':50B 'per':100B 'per-job':99B 'pr':96B 'prior':151C 'python':34B 'read':7A,75B 'record':58B 'remot':116C 'requir':32B,129C 'result':82B,145C 'rout':47B 'self':36B 'self-host':35B 'sensit':120C 'server':16A,44B,106C 'servic':171C 'specif':135C 'state':87B 'tool':29B 'track':15A,43B,105C 'user':5A,11A,73B,77B 'valid':55B,62B,141C 'vulner':112C,114C,133C,162C 'within':138C 'zdi':38B,86B,175C 'zdi-can':174C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted MLflow tracking servers before 3.16.0 that run with multiple authenticated users and use the server's jobs feature. An attacker needs a valid login, then can read other users' job parameters and results, and cancel their jobs. Single-user setups, servers without the jobs feature, and managed MLflow hosting where the vendor patches it can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mlflow"],"ptokens":["mlflow"],"labels":["aitooling","authrequired","medium","mlflow","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118624","severity":null,"published_at":"2026-11-04T00:17:23+00:00","modified_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118624:1593","url":null,"severity":null,"published_at":"2026-11-04T00:49:37+00:00","modified_at":"2026-11-04T00:49:37+00:00","first_seen_at":"2026-11-04T00:49:37+00:00","fetched_at":"2026-11-04T00:49:37+00:00","note":"ZDI-26-840 says fixed in 3.16.0 and links PR #25069. The PR page shows it as open, and a follow-up PR #25102 covers native FastAPI job routes, so the fix may be incomplete there. Lower bound of the affected range unknown. Whether the jobs feature must be enabled: not stated; the flaw is in the job routes. Not verified, ZDI is a coordinator page, not the vendor's own release notes."}],"documents":[{"id":62154,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-840/","title":"ZDI-26-840 MLflow Tracking Server Jobs Missing Authorization","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62156,"url":"https://github.com/mlflow/mlflow/pull/25069","title":"mlflow PR #25069 basic-auth: gate job routes on per-job ownership","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}