CVE-2026-118625: MLflow: missing authorization allows privilege escalation

AWAITING NVD

Published November 3, 2026

CISO Take

MLflow's Tracking Server fails to check authorization in its get_endpoints function (CWE-862), so any authenticated user can reach functionality and resources that should be restricted to higher-privileged users. MLflow is deeply embedded in ML pipelines, with 695 downstream dependents and 95 other CVEs on record, and its OpenSSF Scorecard of 5.4/10 and package risk score of 81/100 point to a weak security track record. Today there is no CISA KEV listing, no public exploit, no Nuclei template, and no EPSS or CVSS score yet, so exploitation is not currently observed. Authentication is required, so the main risk is a low-privileged insider or a compromised service account in a shared tracking server. The advisory (ZDI-26-841) gives no patched version, so check the vendor and ZDI advisory for fixes, restrict access to the server, and review who holds accounts on it.

Sources:NVDZDIOpenSSFATLAS

What is the risk?

Severity and CVSS are not yet scored, so the risk level is provisional. Exploitation requires valid credentials, which lowers exposure from anonymous internet attackers. Impact is a privilege boundary break (confidentiality and integrity of resources protected from the user). Risk is highest in multi-tenant or shared MLflow deployments where experiments, models, and endpoints are separated by role. Public exploit code, KEV listing, and EPSS data are all absent at publication. Treat the risk as moderate-to-high until a vendor score is published.

How does the attack unfold?

Initial Access

Attacker obtains valid low-privilege credentials for the MLflow Tracking Server.

AML.T0012

Exploitation

Attacker calls get_endpoints, which lacks an authorization check, to reach protected functionality.

AML.T0049

Collection

Attacker enumerates and reads endpoint, model, and artifact resources outside their role.

AML.T0035

Impact

Privilege escalation exposes protected ML assets and may enable tampering with deployed models.

Initial Access

Attacker obtains valid low-privilege credentials for the MLflow Tracking Server.

AML.T0012

Exploitation

Attacker calls get_endpoints, which lacks an authorization check, to reach protected functionality.

AML.T0049

Collection

Attacker enumerates and reads endpoint, model, and artifact resources outside their role.

AML.T0035

Impact

Privilege escalation exposes protected ML assets and may enable tampering with deployed models.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 2d ago36% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Check the ZDI-26-841 advisory and MLflow release notes for a fixed version, and upgrade as soon as one is available. 2) Until patched, place the Tracking Server behind a reverse proxy or API gateway that enforces authorization on the endpoints-related routes. 3) Limit network exposure to trusted ML networks and VPN users only. 4) Audit MLflow user accounts and remove stale or shared credentials; apply least privilege. 5) Review access logs for calls to the get_endpoints function or related routes by low-privileged users. 6) Rotate secrets and credentials stored in or reachable from MLflow endpoint configurations if suspicious access is found.

How is it classified?

Auth BypassData LeakageFrameworkAPIAML.T0012- Valid Accounts AML.T0035- AI Artifact Collection AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to AI risks are managed, including mechanisms to address unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-118625?

Is CVE-2026-118625 actively exploited?

No confirmed active exploitation of CVE-2026-118625 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118625?

1) Check the ZDI-26-841 advisory and MLflow release notes for a fixed version, and upgrade as soon as one is available. 2) Until patched, place the Tracking Server behind a reverse proxy or API gateway that enforces authorization on the endpoints-related routes. 3) Limit network exposure to trusted ML networks and VPN users only. 4) Audit MLflow user accounts and remove stale or shared credentials; apply least privilege. 5) Review access logs for calls to the get_endpoints function or related routes by low-privileged users. 6) Rotate secrets and credentials stored in or reachable from MLflow endpoint configurations if suspicious access is found.

What systems are affected by CVE-2026-118625?

This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, model registry, experiment tracking, model serving, training pipelines.

What is the CVSS score for CVE-2026-118625?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

MLOps platformsmodel registryexperiment trackingmodel servingtraining pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0035AI Artifact Collection

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the get_endpoints function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32107.

Exploitation Scenario

An attacker obtains low-privilege credentials for a shared MLflow Tracking Server, for example via a phished data scientist account or a leaked CI token. They call the vulnerable get_endpoints function, which does not verify authorization, and gain access to endpoint resources that should be restricted to administrators or other teams. They use that access to enumerate deployed model endpoints and configuration, harvest credentials or details linked to them, and then pivot to read or tamper with protected models and artifacts in the registry.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.