{"id":"CVE-2026-118626","kind":"vulnerability","aliases":["CVE-2026-118626"],"related":[],"title":"MLflow Tracking Server: missing authorization lets authenticated users escalate privileges","description":"MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the configuration of the BEFORE_REQUEST_HANDLERS. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32108.","summary":"MLflow's tracking server has a missing authorization check in its request handler configuration, so a logged-in user can reach functions meant for higher-privileged users. An attacker with a valid account can gain access to resources normally protected from them.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.16.0"],"affected":"< 3.16.0","ecosystem":"pypi"}],"ecosystems":[],"tags":["ai-tooling","ml-platform","mlflow","python","self-hosted"],"not_affected_if":["default-config","fixed-3.16.0","no-authenticated-users","single-user"],"how_to_check":"- Run `pip show mlflow`; versions below 3.16.0 are affected per ZDI (lower bound unknown).\n- You are exposed only if you run the tracking server with the built-in basic-auth app (`mlflow server --app-name basic-auth`) and have non-admin users. Check whether the Issue REST routes (/mlflow/issues, /mlflow/issues/search) are reachable by users without permission on the experiment.","fix":"Upgrade MLflow to 3.16.0 or later (per ZDI-26-842; the linked PR #25067 was still open in the page I read, so the release itself is not confirmed from MLflow's own page).","status":"open","published_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","triaged_at":"2026-11-04T00:48:02+00:00","updated_at":"2026-11-04T00:49:32+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-04T00:48:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MLflow Tracking Server: missing authorization lets authenticated users escalate privileges","impact":"medium","summary":"MLflow's tracking server has a missing authorization check in its request handler configuration, so a logged-in user can reach functions meant for higher-privileged users. An attacker with a valid account can gain access to resources normally protected from them.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","self-hosted","python","ml-platform"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user gains access to privileged resources","analyst_note":"Confirm affected MLflow version range and whether the BEFORE_REQUEST_HANDLERS configuration is required; check the ZDI advisory for details.","how_to_check":"- Check the installed MLflow version with `pip show mlflow` and compare it against the affected range in the sources (unknown).\n- Look for tracking servers exposed with the BEFORE_REQUEST_HANDLERS configuration set (unknown whether this is the default).","plain_action":"","needs_analyst":true,"not_affected_if":["no-authenticated-users","default-config"],"who_is_affected":"Teams that run a self-hosted MLflow tracking server with user accounts, where a less-privileged user could reach resources they should not see. The sources tie the flaw to the BEFORE_REQUEST_HANDLERS configuration; installations that do not use that configuration or that have no authenticated users are likely not exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4210,"output_tokens":592,"severity_before":"medium"},"analyst_status":"done","analyst_note":"Confirm affected MLflow version range and whether the BEFORE_REQUEST_HANDLERS configuration is required; check the ZDI advisory for details.","search":"'-118626':13A,16A '-2026':12A,15A '32108':146C 'access':66B,123C 'account':63B 'affect':89C 'ai':19B 'ai-tool':18B 'allow':82C,122C 'attack':59B,84C,127C 'authent':7A,93C 'author':5A,36B,76C,119C 'check':37B 'configur':42B,106C 'cve':11A,14A 'escal':9A,78C,86C,133C 'exist':103C 'exploit':97C 'flaw':102C 'function':51B,125C 'gain':65B 'handler':41B,111C 'higher':55B 'higher-privileg':54B 'host':28B 'instal':90C 'issu':74C,113C 'lack':117C 'let':6A 'leverag':129C 'log':46B 'logged-in':45B 'meant':52B 'miss':4A,35B,75C 'ml':22B 'ml-platform':21B 'mlflow':1A,17A,24B,29B,71C,92C 'normal':69B,137C 'platform':23B 'prior':120C 'privileg':10A,56B,77C,87C,134C 'protect':70B,138C 'python':25B 'reach':50B 'remot':83C 'request':40B,110C 'requir':95C 'resourc':68B,136C 'result':114C 'self':27B 'self-host':26B 'server':3A,32B,73C 'specif':101C 'tool':20B 'track':2A,31B,72C 'user':8A,48B,57B,141C 'valid':62B 'vulner':79C,81C,99C,131C 'within':104C 'zdi':144C 'zdi-can':143C","nicknames":[],"mitigations":[],"who_affected":"Teams running a self-hosted MLflow tracking server with the built-in basic-auth plugin and several users. Per the fix PR, the Issue REST APIs had no authorization validator, so any logged-in user could read, create, change or list issues on experiments they have no permission for. Servers with no authentication, a single user, or MLflow 3.16.0 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mlflow"],"ptokens":["mlflow"],"labels":["aitooling","medium","mlflow","mlplatform","python","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-04T00:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118626","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118626","severity":null,"published_at":"2026-11-04T00:17:23+00:00","modified_at":"2026-11-04T00:17:23+00:00","first_seen_at":"2026-11-04T00:46:16+00:00","fetched_at":"2026-11-04T00:46:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118626:1591","url":null,"severity":null,"published_at":"2026-11-04T00:49:32+00:00","modified_at":"2026-11-04T00:49:32+00:00","first_seen_at":"2026-11-04T00:49:32+00:00","fetched_at":"2026-11-04T00:49:32+00:00","note":"ZDI-26-842 says fixed in 3.16.0 and links PR #25067 (basic-auth: gate issue routes on experiment permission); PR page showed state open, so fix not verified against MLflow's release. Affected lower bound unknown. No exploitation or PoC seen. Nothing marked verified (ZDI is a third party)."}],"documents":[{"id":62157,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-842/","title":"ZDI-26-842 MLflow Tracking Server Issues Missing Authorization Privilege Escalation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":62158,"url":"https://github.com/mlflow/mlflow/pull/25067","title":"mlflow PR #25067 [3/6] basic-auth: gate issue routes on experiment permission","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}