Live › vulnerability › CVE-2026-118625
MLflow's tracking server does not check authorization in its get_endpoints function before granting access. An authenticated remote user can use this to reach resources normally reserved for other users.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Teams running a self-hosted MLflow tracking server with authentication enabled (the basic-auth app) and non-admin user accounts, on a version below 3.16.0. An authenticated low-privilege user can reach functionality that should be protected from them. Servers with no auth, single-user local installs, or only trusted users carry less risk. The first affected version is not stated.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mlflow | pypi | < 3.16.0 (lower bound unknown) | 3.16.0 |
mlflow --version (or pip show mlflow mlflow-skinny); versions below 3.16.0 are not fixed.mlflow server --app-name basic-auth) and has non-admin users; the fix PR concerns basic-auth before-request validators.Upgrade MLflow to 3.16.0 (per ZDI-26-841; fix PR mlflow/mlflow#24354)
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.
The specific flaw exists within the get_endpoints function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32107.
This page as .md · .json · in your agent: get_signal("CVE-2026-118625")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.