HighVulnerability
CVE-2026-118626: MLflow Tracking Server privilege escalation via missing authorization
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-118626
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
A missing authorization flaw in the MLflow Tracking Server lets a remote attacker escalate privileges on affected installations. The specific flaw exists in the configuration of BEFORE_REQUEST_HANDLERS, where access to functionality is granted without an authorization check. Exploitation requires authentication, and the issue is tracked as ZDI-CAN-32108.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.