ZDI-CAN-32107: ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability

Published Oct 29, 2026

Updated

This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118625.

Event History

Oct 29, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

An attacker must already be authenticated to the affected MLflow Tracking Server. The vulnerability is remote and can then be used to escalate privileges.

What is the assigned severity?

ZDI assigned this vulnerability a CVSS rating of 6.3.

ZDI-CAN-32107: ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the assigned severity?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the assigned severity?