MLflow Tracking Server
CVE-2026-118626
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged MLflow user
-
ExploitSend request to unauthorized handler endpoint
-
ExecutionBypass missing authorization check
-
ImpactAccess/modify protected resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid authenticated session on the MLflow Tracking Server (PR:L), so the server's authentication/authorization feature must be in use and the attacker must already hold at least low-privileged credentials. The concrete prerequisite is reaching functionality gated by the BEFORE_REQUEST_HANDLERS configuration, which lacks an authorization check before granting access; a low-privileged user can therefore reach resources meant to be restricted. Limiting factors: no anonymous/unauthenticated path (credentials or an account are required), impact is bounded to low confidentiality and integrity with no availability effect, and the deployment must expose a multi-tier privilege model where some resources are protected from the authenticated user. |
| Impact | This is a moderate-severity, authenticated access-control flaw (CVSS 3.0 base 5.4; CWE-862 Missing Authorization) rather than a top-priority emergency. The CVSS vector CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N confirms a network-reachable issue with low attack complexity but requiring prior authentication (PR:L) and yielding only low confidentiality and integrity impact with no availability impact - consistent with a privilege-escalation-to-protected-resources outcome rather than full system takeover. No EPSS score, no CISA KEV listing, and no SSVC machine-readable decision were supplied; the only prioritization signal is the vuln.today 'this_month' decision label, which positions this below act_now/emergency urgency. There is no verified public exploit code - the sole reference is the ZDI advisory (ZDI-26-842) describing the disclosure, not a weaponized PoC. Signals are broadly consistent (authenticated, limited impact, non-urgent label); the main limitation is sparse multi-source data - there is no NVD-published CVSS at the reference, no affected/fixed version range, and no EPSS, so widespread-exploitation likelihood cannot be independently quantified. Net: a real but manageable issue for environments running MLflow with authentication enabled and multiple privilege tiers. |
| Exploit ScenarioDerived | An attacker who already holds valid low-privileged credentials on an MLflow Tracking Server sends crafted requests to functionality whose BEFORE_REQUEST_HANDLERS fail to enforce an authorization check, reaching resources that should be restricted to higher-privileged users. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N, this is a low-complexity, no-user-interaction action over the network requiring only an authenticated session. No verified working exploit code is public; only the ZDI advisory describes the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 04, 2026
Authenticated privilege escalation in MLflow Tracking Server lets a low-privileged user reach functionality and resources that should be restricted from their account, because the server's BEFORE_REQUEST_HANDLERS configuration grants access without a prior authorization check (CWE-862 Missing Authorization). Exploitation requires a valid authenticated session (CVSS 3.0 base 5.4, AV:N/AC:L/PR:L/UI:N, low confidentiality and integrity impact, no availability impact), so deployments that do not enforce a multi-tier privilege model are largely unaffected. There is no CISA KEV entry and no public exploit identified at time of analysis, and the issue is tracked under ZDI-CAN-32108 / ZDI-26-842 rather than being treated as an emergency.
RemediationAI
No vendor-released patch version is identified in the available data, so the actionable step is to consult ZDI-26-842 (https://www.zerodayinitiative.com/advisories/ZDI-26-842/) for the vendor's fixed-release guidance and upgrade to the MLflow Tracking Server version named there as soon as it is confirmed for your branch. As a compensating control, audit the BEFORE_REQUEST_HANDLERS configuration and remove or restrict any handler entries that expose administrative or cross-tenant functionality without an authorization check - the trade-off is that removing a handler may disable the custom routing, logging, or preprocessing behaviour it provided. Additionally, since exploitation requires an authenticated account (PR:L), reducing the population of low-privileged tracking users and segregating administrative and experiment-tracking endpoints onto separate deployments limits who can reach the unprotected path, at the cost of extra operational overhead; narrowing network exposure of the tracking server to trusted clients is a further stopgap but does not address insider or credential-holding attackers.
Affected ProductsAI
MLflow Tracking Server installations whose BEFORE_REQUEST_HANDLERS configuration is in use and whose deployment exposes a privilege tier that should be shielded from ordinary authenticated users are affected; the input data provides no version range and no CPE strings, so no specific release boundaries can be asserted. The authoritative technical detail is published by Trend Micro's Zero Day Initiative as ZDI-26-842 (originating case ZDI-CAN-32108) at https://www.zerodayinitiative.com/advisories/ZDI-26-842/, and the NVD reference in this dataset points to that same ZDI advisory; administrators should confirm their exact MLflow release and handler configuration against it before concluding exposure.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an access-control design defect (CWE-862, Missing Authorization) resident in the configuration of MLflow Tracking Server's BEFORE_REQUEST_HANDLERS - the request-time hook layer that is consulted before routed functionality is served. Because no authorization decision is made in that path, an authenticated caller can reach resources that the deployment intends to protect from low-privileged users, which is what the tags classify as authentication bypass and privilege escalation. The supplied evidence does not describe the exact trigger beyond the missing check in the before-request handler configuration, does not specify which handler combinations or which MLflow release branches are affected, and provides no CPE data or version range, so the affected surface must be confirmed against the vendor and ZDI advisory rather than inferred. The CVSS vector indicates PR:L (a low-privileged authenticated principal is required) and a network-reachable attack path, with scope unchanged and impact limited to low confidentiality and integrity loss; the trigger mechanism and any additional preconditions beyond reaching the unprotected handler functionality are not described in the available sources.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable with low complexity but requires an authenticated low-privileged account (PR:L); missing authorization yields limited confidentiality and integrity gain and no availability impact, scope unchanged.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
DescriptionCVE.org
MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.
The specific flaw exists within the configuration of the BEFORE_REQUEST_HANDLERS. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32108.
Threat Intelligence Overview
NVD
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
GitHub PoC
Exploit-DB