---
id: "CVE-2026-118624"
kind: "vulnerability"
aliases: ["CVE-2026-118624"]
title: "MLflow: logged-in users can read and cancel other users' jobs on the tracking server (basic-auth)"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mlflow", "fixed": ["3.16.0"], "affected": "< 3.16.0", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "auth-required", "mlflow", "python", "self-hosted"]
not_affected_if: ["auth-required"]
published_at: "2026-11-04T00:17:23+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:49:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118624", "first_seen_at": "2026-11-04T00:46:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:49:37+00:00"}]
---

# MLflow: logged-in users can read and cancel other users' jobs on the tracking server (basic-auth)

ZDI-26-840: the MLflow tracking server's job routes (GET /mlflow/jobs/<id>, PATCH /mlflow/jobs/cancel/<id>) had no authorization validator and jobs recorded no owner (_find_validator). Under the built-in basic-auth, any authenticated user could read another user's job parameters and results, and cancel it. ZDI states it is fixed in MLflow 3.16.0; the linked PR adds a per-job creator check.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mlflow affected < 3.16.0 fixed 3.16.0

## How to check

Run 'mlflow --version' (or pip show mlflow); versions before 3.16.0 are affected per ZDI. Check whether your tracking server runs with the built-in basic-auth app (mlflow server --app-name basic-auth) and whether anything submits jobs through the server's jobs API. Start of the affected range is not stated by ZDI (one aggregator lists 3.13.0, unconfirmed).

## Fix

Upgrade MLflow to 3.16.0 (per ZDI-26-840). The fix adds a nullable jobs.creator column through a database migration and restricts job fetch/cancel to the creator; admins are exempt. Jobs created before the upgrade have no creator and are denied to non-admins.

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118624
- 2026-11-04T00:49:37+00:00 analyst — ZDI-26-840 says fixed in 3.16.0 and links PR #25069. The PR page shows it as open, and a follow-up PR #25102 covers native FastAPI job routes, so the fix may be incomplete there. Lower bound of the affected range unknown. Whether the jobs feature must be enabled: not stated; the flaw is in the job routes. Not verified, ZDI is a coordinator page, not the vendor's own release notes.

## Documents

- [advisory] ZDI-26-840 MLflow Tracking Server Jobs Missing Authorization https://www.zerodayinitiative.com/advisories/ZDI-26-840/
- [fix] mlflow PR #25069 basic-auth: gate job routes on per-job ownership https://github.com/mlflow/mlflow/pull/25069

## From the sources

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability.

The specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_