{"id":"CVE-2026-118625","kind":"vulnerability","aliases":["CVE-2026-118625"],"related":[],"title":"MLflow Tracking Server: missing authorization lets users reach protected resources","description":"MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the get_endpoints function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32107.","summary":"MLflow's tracking server does not check authorization in its get_endpoints function before granting access. An authenticated remote user can use this to reach resources normally reserved for other users.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.16.0"],"affected":"< 3.16.0 (lower bound unknown)","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","auth-required","mlflow","python","self-hosted"],"not_affected_if":["auth-required","single-user-local"],"how_to_check":"- Run `mlflow --version` (or `pip show mlflow mlflow-skinny`); versions below 3.16.0 are not fixed.\n- Check whether the tracking server runs with the basic-auth app (`mlflow server --app-name basic-auth`) and has non-admin users; the fix PR concerns basic-auth before-request validators.\n- The first affected version is not stated in the sources read.","fix":"Upgrade MLflow to 3.16.0 (per ZDI-26-841; fix PR mlflow/mlflow#24354)","status":"open","published_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:47:59+00:00","updated_at":"2026-11-04T00:49:29+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-04T00:47:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MLflow Tracking Server: missing authorization lets users reach protected resources","impact":"medium","summary":"MLflow's tracking server does not check authorization in its get_endpoints function before granting access. An authenticated remote user can use this to reach resources normally reserved for other users.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","self-hosted","python"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user reaches protected resources beyond their role","analyst_note":"Find the affected MLflow version ranges and fixed release in the NVD entry or the ZDI advisory (ZDI-CAN-32107) and confirm whether the flaw is reachable over the network.","how_to_check":"- Confirm whether an MLflow tracking server is deployed, and note its version with `mlflow --version`\n- Check whether the server runs with authentication enabled and with multiple user roles\n- unknown for affected version ranges, as the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["single-user-local","auth-required"],"who_is_affected":"Teams running a shared MLflow tracking server where more than one user holds an account. The flaw requires an authenticated user, so single-user local installs and servers reachable only by trusted operators carry less risk. The sources do not list affected version ranges.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4188,"output_tokens":534,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Find the affected MLflow version ranges and fixed release in the NVD entry or the ZDI advisory (ZDI-CAN-32107) and confirm whether the flaw is reachable over the network.","search":"'-118625':13A,16A '-2026':12A,15A '32107':131C 'access':44B,108C 'affect':77C 'ai':19B 'ai-tool':18B 'allow':70C,107C 'attack':72C,112C 'auth':22B 'auth-requir':21B 'authent':46B,81C 'author':5A,36B,64C,104C 'check':35B 'cve':11A,14A 'endpoint':40B,95C 'escal':66C,74C,118C 'exist':91C 'exploit':85C 'flaw':90C 'function':41B,96C,110C 'get':39B,94C 'grant':43B 'host':28B 'instal':78C 'issu':98C 'lack':102C 'let':6A 'leverag':114C 'miss':4A,63C 'mlflow':1A,17A,24B,29B,60C,80C 'normal':55B,122C 'prior':105C 'privileg':65C,75C,119C 'protect':9A,123C 'python':25B 'reach':8A,53B 'remot':47B,71C 'requir':23B,83C 'reserv':56B 'resourc':10A,54B,121C 'result':99C 'self':27B 'self-host':26B 'server':3A,32B,62C 'specif':89C 'tool':20B 'track':2A,31B,61C 'use':50B 'user':7A,48B,59B,126C 'vulner':67C,69C,87C,116C 'within':92C 'zdi':129C 'zdi-can':128C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted MLflow tracking server with authentication enabled (the basic-auth app) and non-admin user accounts, on a version below 3.16.0. An authenticated low-privilege user can reach functionality that should be protected from them. Servers with no auth, single-user local installs, or only trusted users carry less risk. The first affected version is not stated.","tier":"B","verified":{"fix":{"at":"2026-11-04T00:49:29Z","by":"analyst","doc":"https://github.com/mlflow/mlflow/pull/24354","run_id":1592}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mlflow"],"ptokens":["mlflow"],"labels":["aitooling","authrequired","medium","mlflow","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118625","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118625","severity":null,"published_at":"2026-11-04T00:17:23+00:00","modified_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118625:1592","url":null,"severity":null,"published_at":"2026-11-04T00:49:29+00:00","modified_at":"2026-11-04T00:49:29+00:00","first_seen_at":"2026-11-04T00:49:29+00:00","fetched_at":"2026-11-04T00:49:29+00:00","note":"ZDI-26-841 (vendor-coordinated) says fixed in MLflow 3.16.0 via PR #24354; PR touches basic-auth before-request validators built from get_endpoints. Affected lower bound not stated anywhere I read. Not exploited, no PoC seen. Network-reachable per CVSS AV:N, PR:L. Linkage of PR to CVE is by ZDI's statement."}],"documents":[{"id":62153,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-841/","title":"ZDI-26-841 MLflow Tracking Server Missing Authorization","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62155,"url":"https://github.com/mlflow/mlflow/pull/24354","title":"mlflow PR #24354: Fix basic-auth before-request validators invoking view functions","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}