MLflow Tracking Server CVE-2026-118624
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged MLflow user
-
ExploitSend request to unprotected jobs endpoint
-
ExecutionBypass missing authorization in _find_validator
-
ImpactDisclose sensitive data as service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid authenticated session on the MLflow Tracking Server (PR:L confirmed by CVSS vector): the attacker must already be a low-privileged user able to reach the jobs functionality. Exploitation then succeeds because the _find_validator code path performs no authorization check before granting access, so no special non-default configuration is described as necessary beyond having the Tracking Server exposed and the attacker holding any authenticated account. Limiting factors: exploitation is bounded to confidentiality impact in the context of the service account, needs network reachability to the Tracking Server, and cannot be performed by a fully unauthenticated attacker. The specific trigger beyond reaching the jobs/_find_validator path is not further detailed in the available sources. |
| Impact | This is a moderate-severity information-disclosure issue (CVSS 5.4, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L) rooted in a missing authorization check (CWE-862) in MLflow's _find_validator function. The network vector with low complexity and no user interaction makes exploitation straightforward, but PR:L means an already-authenticated low-privileged account is required, which meaningfully constrains the attacker population to users who already have some access to the Tracking Server. No EPSS score was supplied, there is no CISA KEV listing, and no public exploit was identified, so there is no signal of active or widespread exploitation. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a real-but-not-urgent authorization gap: it should be patched on a normal prioritized cycle rather than treated as a fire drill. The confidentiality impact is rated Low (partial disclosure in the context of the service account), not a full compromise. Note a minor inconsistency: the supplied CVSS:3.0 vector includes A:L (availability impact) while the description characterizes the flaw purely as information disclosure - verify with the vendor/ZDI advisory whether any availability effect actually applies. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authenticated account on an MLflow Tracking Server sends a request to the jobs functionality that lacks an authorization check, reaching the _find_validator code path without the expected access controls. This lets them read sensitive information available in the context of the service account. No public exploit code was identified, so exploitation currently depends on an attacker independently reproducing the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
MLflow Tracking Server discloses sensitive information to any authenticated low-privileged user through its jobs functionality, because the _find_validator code path performs no authorization check before granting access to the underlying functionality (CWE-862, CVSS 5.4). Exploitation requires a valid session on the Tracking Server - the assessed vector confirms PR:L, so remote unauthenticated attackers cannot exploit it - plus network reachability to the server, and the exposure is bounded to confidentiality in the context of the service account. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vuln.today priority decision is remediation this month, and the reference ZDI-26-840 carries the vendor disclosure detail.
RemediationAI
No vendor-released patch or fixed version is identified in the available data for this record - treat that as an absence of information, not a confirmation that no fix exists, and check the ZDI advisory ZDI-26-840 (https://www.zerodayinitiative.com/advisories/ZDI-26-840/) for the current vendor position and any patched release before planning upgrades. Until a fix is confirmed, the compensating controls that follow from the assessed preconditions are to restrict network reachability to the Tracking Server (bind it to an internal interface, firewall it to trusted hosts, or place it behind an authenticating proxy), which reduces exposure but does not remove the missing authorization check inside _find_validator; and to tightly control who is issued Tracking Server accounts and what job-related permissions those accounts carry, since every authenticated principal is potentially able to reach the vulnerable jobs path - the trade-off is that limiting accounts or the jobs feature narrows legitimate ML workflow usage. Because the disclosure happens in the context of the service account, review server logs for jobs/_find_validator access by low-privileged users and consider reducing the privileges of the account the Tracking Server runs as, so that any disclosed data is limited.
Affected ProductsAI
MLflow Tracking Server installations exposing the jobs functionality are affected; no CPE strings were supplied with this record, so exact version ranges are not confirmed from the available data. The flaw is in the _find_validator code path of the Tracking Server, meaning deployments where the server is exposed to users holding any authenticated account are in scope, while purely local or single-user MLflow library usage is not the described attack surface. The authoritative affected-version information and the vendor's own statement are published in the Zero Day Initiative advisory ZDI-26-840 at https://www.zerodayinitiative.com/advisories/ZDI-26-840/, which should be consulted before scoping remediation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MLflow is an open-source machine-learning lifecycle platform, and its Tracking Server is the component that exposes experiment tracking, run metadata and job management over HTTP/REST. The flaw sits in the _find_validator function, which reaches and returns data from the jobs functionality without first verifying that the calling principal is authorized for the requested resource - the classic CWE-862 (Missing Authorization) pattern, where authentication succeeds but function-level access control is absent. Note the reference tags label this both 'Authentication Bypass' and 'Information Disclosure', but the CVSS vector (PR:L) and the independent assessment both confirm an already-authenticated attacker, so the operative weakness is a missing authorization check rather than a pre-authentication bypass; the attacker must already be a low-privileged user able to reach the jobs functionality. There is also a scoring discrepancy worth flagging: the published CVSS:3.0 vector carries A:L while the assessed CVSS:3.1 vector sets A:N and I:N, so the credible impact is confidentiality only, in the context of the service account. The specific trigger beyond reaching the jobs / _find_validator path is not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Network-reachable with low complexity and no UI, but requires an authenticated low-privileged account (PR:L); impact is partial information disclosure only, so C:L and I/A:N.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability.
The specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
GitHub PoC
Exploit-DB