CVE-2026-118626: MLflow: missing authorization allows privilege escalation

AWAITING NVD

Published November 3, 2026

CISO Take

MLflow's tracking server fails to enforce authorization in its BEFORE_REQUEST_HANDLERS configuration (CWE-862), so an authenticated low-privilege user can reach functionality and resources that should be off-limits to them. MLflow is core ML lifecycle infrastructure with 695 downstream dependents, 95 other tracked CVEs and a package risk score of 81/100, so a flaw in its access controls can expose experiments, models, and artifacts across many teams. There is no CISA KEV listing, no public exploit and no Nuclei template at this time, and EPSS and CVSS scores have not yet been published, so urgency is moderate and should be re-evaluated as scoring arrives. Authentication is required, which limits exposure to insiders and to attackers holding stolen or shared credentials. Check ZDI-26-842 for the fixed version, patch as soon as it is available, and in the meantime restrict network access to the tracking server and audit permission changes and cross-user access in its logs.

Sources:NVDATLASOpenSSFZero Day Initiative

What is the risk?

Moderate, pending scoring. Exploitation needs valid credentials, but the attack is a straightforward missing-authorization flaw with no user interaction, which usually means low complexity. Severity and CVSS are not yet assigned, and the affected and patched version ranges are not stated in the available data. There is no public exploit, no scanner template and no KEV listing, so there is no sign of in-the-wild exploitation. Impact is high wherever MLflow is shared across teams or tenants, because the integrity and confidentiality of experiments, models, and registry entries depend on these access controls. Scorecard of 5.4/10 indicates average project security hygiene.

How does the attack unfold?

Initial Access

Attacker authenticates to the MLflow tracking server with low-privilege or stolen credentials.

AML.T0012

Exploitation

Attacker calls protected functionality that lacks an authorization check in the before-request handlers.

AML.T0049

Collection

Attacker reads experiments, artifacts, and registered models belonging to other users or projects.

AML.T0035

Impact

Attacker escalates permissions and tampers with models or metadata that feed downstream pipelines.

Initial Access

Attacker authenticates to the MLflow tracking server with low-privilege or stolen credentials.

AML.T0012

Exploitation

Attacker calls protected functionality that lacks an authorization check in the before-request handlers.

AML.T0049

Collection

Attacker reads experiments, artifacts, and registered models belonging to other users or projects.

AML.T0035

Impact

Attacker escalates permissions and tampers with models or metadata that feed downstream pipelines.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	—	No patch
28.6KOpenSSF 5.4695 dependentsPushed 3d ago36% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

6 steps

Review ZDI-26-842 and the MLflow release notes, then upgrade to the first fixed release once identified.
Until patched, place the tracking server behind a reverse proxy or API gateway that enforces authorization per route and per user, and do not expose it to the internet.
Limit accounts to those who need access and rotate credentials of shared or service accounts.
Audit MLflow logs and the permissions database for unexpected permission grants, admin actions, or access to experiments and models outside a user's scope.
Require approval and artifact signing or hash verification before models are promoted from the registry to production.
Monitor for the publication of CVSS, EPSS, and exploit code and re-triage when they appear.

How is it classified?

Auth BypassData LeakageFrameworkTraining DataAML.T0012- Valid Accounts AML.T0035- AI Artifact Collection AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.4.2-Resource documentation and access to AI system resources

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and manage AI system security

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-118626?

Is CVE-2026-118626 actively exploited?

No confirmed active exploitation of CVE-2026-118626 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118626?

1. Review ZDI-26-842 and the MLflow release notes, then upgrade to the first fixed release once identified. 2. Until patched, place the tracking server behind a reverse proxy or API gateway that enforces authorization per route and per user, and do not expose it to the internet. 3. Limit accounts to those who need access and rotate credentials of shared or service accounts. 4. Audit MLflow logs and the permissions database for unexpected permission grants, admin actions, or access to experiments and models outside a user's scope. 5. Require approval and artifact signing or hash verification before models are promoted from the registry to production. 6. Monitor for the publication of CVSS, EPSS, and exploit code and re-triage when they appear.

What systems are affected by CVE-2026-118626?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, experiment tracking, model registries, MLOps platforms, model serving.

What is the CVSS score for CVE-2026-118626?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

training pipelinesexperiment trackingmodel registriesMLOps platformsmodel serving

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0035AI Artifact Collection

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.4.2

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the configuration of the BEFORE_REQUEST_HANDLERS. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-32108.

Exploitation Scenario

An attacker obtains low-privilege credentials for a shared MLflow tracking server, for example through a phished data scientist account or a leaked service token. They send requests to endpoints that should be restricted, and because the authorization check is missing in the before-request handler chain, the server processes them. The attacker reads experiments and artifacts from other teams, grants themselves broader permissions, and modifies or replaces a registered model version. A downstream deployment pipeline then promotes the tampered model to production.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.