MLflow Tracking Server issues missing authorization allows privilege escalation
Original title: ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
Authenticated remote attackers can raise privileges; ZDI rates CVE-2026-118626 at CVSS 5.4, with no fix listed.
The Zero Day Initiative published ZDI-26-842, a missing-authorization flaw in the MLflow Tracking Server issues function. An authenticated remote attacker can escalate privileges on affected MLflow installations. ZDI assigned CVE-2026-118626 a CVSS score of 5.4. The notice does not list affected versions, a patch, or exploitation.
Unconfirmed: Affected versions, a fix, and real-world exploitation are not stated.
- Authentication is required before the flaw can be exploited.
- The advisory identifier is ZDI-26-842.
- No affected version range or fixed release is stated.
Impact: authenticated remote privilege escalation on MLflow
| Product | Affected |
|---|---|
| MLflow Tracking Server | — |
- CVEs
- CVE-2026-118626
- Products
- MLflowMLflow Tracking Server
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-118626 | — | — | — |
From the original article
This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.