ZDI-CAN-32108: ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

Published Oct 29, 2026

Updated

This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118626.

Frequently Asked Questions

What level of access does an attacker need before exploiting this issue?

The attacker must be authenticated to the affected MLflow installation. The available information does not identify which authenticated role or permissions are sufficient.

Can this vulnerability be exploited remotely?

Yes. The advisory describes it as allowing remote attackers to escalate privileges on affected installations.

ZDI-CAN-32108: ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

Frequently Asked Questions

What level of access does an attacker need before exploiting this issue?

Can this vulnerability be exploited remotely?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need before exploiting this issue?

Can this vulnerability be exploited remotely?