MLflow Tracking Server CVE-2026-118625

Exploitation requires a valid, authenticated low-privilege account on the MLflow Tracking Server (PR:L) and network reachability to the server (AV:N). The specific trigger is reaching the get_endpoints function, which performs no authorization check before granting access. No special non-default configuration, user interaction, or platform-specific setting is stated in the available sources as a prerequisite. The primary limiting factor is the authentication requirement: unauthenticated outsiders cannot exploit this directly, so realistic risk is highest where MLflow is multi-tenant or exposes accounts to many users.

This is a moderate-severity authorization flaw (CVSS 6.3, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) in the MLflow Tracking Server. The network attack vector and low complexity (AV:N/AC:L) make it reachable and repeatable, but PR:L means an attacker must already hold valid low-privilege credentials, which materially limits the exploit population to insiders or anyone who has obtained a foothold account. The impact is bounded: partial confidentiality, integrity, and availability (C:L/I:L/A:L) with an unchanged scope (S:U), consistent with escalating to resources normally protected from the user rather than full system takeover. No EPSS score is present in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV, and no public exploit is identified - the only reference is a Trend Micro ZDI advisory, which is a vulnerability disclosure, not exploit code. The vuln.today decision label is 'this_month' rather than act_now/emergency, which aligns with a real-but-not-urgent authenticated privilege-escalation issue. Net: a genuine priority for organizations exposing MLflow to multiple users, but not a drop-everything emergency given the authentication requirement and absence of known active exploitation.

An attacker who already holds a low-privilege account on an MLflow Tracking Server sends requests to the get_endpoints functionality, which fails to enforce authorization before granting access. Because the attack is network-based and low-complexity, the authenticated user can reach resources and functionality normally restricted from them, escalating their effective privileges. No public exploit code is identified for this issue at the time of analysis.