Live › vulnerability › CVE-2026-118626
MLflow's tracking server has a missing authorization check in its request handler configuration, so a logged-in user can reach functions meant for higher-privileged users. An attacker with a valid account can gain access to resources normally protected from them.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-04 00:46 UTC. All times on this page are UTC.
Teams running a self-hosted MLflow tracking server with the built-in basic-auth plugin and several users. Per the fix PR, the Issue REST APIs had no authorization validator, so any logged-in user could read, create, change or list issues on experiments they have no permission for. Servers with no authentication, a single user, or MLflow 3.16.0 or later can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mlflow | pypi | < 3.16.0 | 3.16.0 |
pip show mlflow; versions below 3.16.0 are affected per ZDI (lower bound unknown).mlflow server --app-name basic-auth) and have non-admin users. Check whether the Issue REST routes (/mlflow/issues, /mlflow/issues/search) are reachable by users without permission on the experiment.Upgrade MLflow to 3.16.0 or later (per ZDI-26-842; the linked PR #25067 was still open in the page I read, so the release itself is not confirmed from MLflow's own page).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.
The specific flaw exists within the configuration of the BEFORE_REQUEST_HANDLERS. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32108.
This page as .md · .json · in your agent: get_signal("CVE-2026-118626")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.