CVE-2026-118624: MLflow missing authz in jobs

CISO Take

CVE-2026-118624 is a missing-authorization flaw (CWE-862) in the MLflow Tracking Server's jobs functionality, where the _find_validator function fails to enforce access checks, letting any authenticated user read information they should not see in the context of the service account. MLflow has 695 downstream dependents, 95 other CVEs on record and an OpenSSF Scorecard of 5.4/10, so this is another entry in a package with a weak security track record. There is no CVSS, EPSS or KEV data yet, no public exploit and no Nuclei template, so exploitation likelihood is currently low, but ZDI-reported authorization bugs are usually simple to reproduce once details are public. The practical risk is in multi-tenant or shared tracking servers where experiment metadata, run parameters, artifact paths and possibly credentials could leak to low-privileged users. No fixed version is listed yet, so review the ZDI-26-840 advisory and the MLflow release notes for a patch, restrict Tracking Server access to trusted users, and put it behind network controls until you can upgrade.

Sources:NVDZDIOpenSSFATLAS

What is the risk?

Medium, provisional because no CVSS or EPSS score has been published. The flaw needs valid authentication, which lowers exposure, but it is a low-complexity authorization gap and the package has a high risk score (81/100). Impact is mainly confidentiality: data is disclosed in the context of the service account, which may have broader access than the calling user. Risk rises sharply for shared or internet-reachable tracking servers that use basic auth or SSO with many low-trust users. No public exploit or KEV listing exists as of publication.

How does the attack unfold?

Initial Access

The attacker authenticates to the MLflow Tracking Server with low-privileged or stolen credentials.

AML.T0012

Exploitation

The attacker calls jobs functionality where the _find_validator function applies no authorization check.

AML.T0049

Collection

The attacker reads job, run and experiment information belonging to other users via the service account.

AML.T0036

Impact

Leaked paths, metadata or secrets lead to exposure of model IP and further access to artifact stores.

AML.T0048.004

Initial Access

The attacker authenticates to the MLflow Tracking Server with low-privileged or stolen credentials.

AML.T0012

Exploitation

The attacker calls jobs functionality where the _find_validator function applies no authorization check.

AML.T0049

Collection

The attacker reads job, run and experiment information belonging to other users via the service account.

AML.T0036

Impact

Leaked paths, metadata or secrets lead to exposure of model IP and further access to artifact stores.

AML.T0048.004

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 2d ago36% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Check the ZDI-26-840 advisory and the MLflow release notes and upgrade to the fixed version once it is published; the affected and patched ranges are not yet listed. 2) Until then, limit Tracking Server access to trusted users and networks, and do not expose it to the internet. 3) Run the service account with least privilege, with scoped credentials for artifact stores and databases. 4) Restrict or disable the jobs functionality if it is not needed. 5) Monitor access logs for unusual calls to jobs endpoints by low-privileged accounts and for enumeration of other users' resources. 6) Track MLflow in your SBOM and subscribe to advisories for it.

How is it classified?

Data LeakageAuth BypassFrameworkTraining DataAML.T0007- Discover AI Artifacts AML.T0012- Valid Accounts AML.T0036- Data from Information Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

Frequently Asked Questions

What is CVE-2026-118624?

CVE-2026-118624 is a missing-authorization flaw (CWE-862) in the MLflow Tracking Server's jobs functionality, where the _find_validator function fails to enforce access checks, letting any authenticated user read information they should not see in the context of the service account. MLflow has 695 downstream dependents, 95 other CVEs on record and an OpenSSF Scorecard of 5.4/10, so this is another entry in a package with a weak security track record. There is no CVSS, EPSS or KEV data yet, no public exploit and no Nuclei template, so exploitation likelihood is currently low, but ZDI-reported authorization bugs are usually simple to reproduce once details are public. The practical risk is in multi-tenant or shared tracking servers where experiment metadata, run parameters, artifact paths and possibly credentials could leak to low-privileged users. No fixed version is listed yet, so review the ZDI-26-840 advisory and the MLflow release notes for a patch, restrict Tracking Server access to trusted users, and put it behind network controls until you can upgrade.

Is CVE-2026-118624 actively exploited?

No confirmed active exploitation of CVE-2026-118624 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118624?

1) Check the ZDI-26-840 advisory and the MLflow release notes and upgrade to the fixed version once it is published; the affected and patched ranges are not yet listed. 2) Until then, limit Tracking Server access to trusted users and networks, and do not expose it to the internet. 3) Run the service account with least privilege, with scoped credentials for artifact stores and databases. 4) Restrict or disable the jobs functionality if it is not needed. 5) Monitor access logs for unusual calls to jobs endpoints by low-privileged accounts and for enumeration of other users' resources. 6) Track MLflow in your SBOM and subscribe to advisories for it.

What systems are affected by CVE-2026-118624?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model registry, experiment tracking, MLOps platforms.

What is the CVSS score for CVE-2026-118624?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesmodel registryexperiment trackingMLOps platforms

MITRE ATLAS Techniques

AML.T0007Discover AI Artifacts

AML.T0012Valid Accounts

AML.T0036Data from Information Repositories

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894.

Exploitation Scenario

An attacker obtains low-privileged credentials to a shared MLflow Tracking Server, for example through a phished data scientist account or a reused password. They call the jobs endpoints, where the missing authorization check lets them query job information outside their permissions. They collect other teams' experiment metadata, parameters, artifact locations and any secrets exposed in job details. They then use the leaked storage paths or credentials to reach model artifacts and training data, enabling IP theft or further lateral movement.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.