---
id: "CVE-2026-118625"
kind: "vulnerability"
aliases: ["CVE-2026-118625"]
title: "MLflow Tracking Server: missing authorization lets users reach protected resources"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mlflow", "fixed": ["3.16.0"], "affected": "< 3.16.0 (lower bound unknown)", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "auth-required", "mlflow", "python", "self-hosted"]
not_affected_if: ["auth-required", "single-user-local"]
published_at: "2026-11-04T00:17:23+00:00"
first_seen_at: "2026-11-04T00:46:16+00:00"
updated_at: "2026-11-04T00:49:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118625", "first_seen_at": "2026-11-04T00:46:16+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T00:49:29+00:00"}]
---

# MLflow Tracking Server: missing authorization lets users reach protected resources

MLflow's tracking server does not check authorization in its get_endpoints function before granting access. An authenticated remote user can use this to reach resources normally reserved for other users.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mlflow affected < 3.16.0 (lower bound unknown) fixed 3.16.0

## How to check

- Run `mlflow --version` (or `pip show mlflow mlflow-skinny`); versions below 3.16.0 are not fixed.
- Check whether the tracking server runs with the basic-auth app (`mlflow server --app-name basic-auth`) and has non-admin users; the fix PR concerns basic-auth before-request validators.
- The first affected version is not stated in the sources read.

## Fix

Upgrade MLflow to 3.16.0 (per ZDI-26-841; fix PR mlflow/mlflow#24354)

## Timeline

- 2026-11-04T00:46:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118625
- 2026-11-04T00:49:29+00:00 analyst — ZDI-26-841 (vendor-coordinated) says fixed in MLflow 3.16.0 via PR #24354; PR touches basic-auth before-request validators built from get_endpoints. Affected lower bound not stated anywhere I read. Not exploited, no PoC seen. Network-reachable per CVSS AV:N, PR:L. Linkage of PR to CVE is by ZDI's statement.

## Documents

- [advisory] ZDI-26-841 MLflow Tracking Server Missing Authorization https://www.zerodayinitiative.com/advisories/ZDI-26-841/
- [fix] mlflow PR #24354: Fix basic-auth before-request validators invoking view functions https://github.com/mlflow/mlflow/pull/24354

## From the sources

MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.

The specific flaw exists within the get_endpoints function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32107.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_