Privilege Escalation in MLflow Tracking Server (CVE‑2026‑118625) Allows Authenticated Attackers to Gain Elevated Access
What It Is — The Zero Day Initiative advisory (ZDI‑26‑841) details a missing authorization check in the get_endpoints function of the MLflow Tracking Server. An authenticated remote attacker can invoke this function to bypass intended access controls and elevate privileges to resources normally restricted. The flaw is assigned CVE‑2026‑118625, carries a CVSS 6.3 (Network, Low complexity, Low privileges required, No user interaction, Confidentiality Low, Integrity Low, Availability Low) and is fixed in MLflow 3.16.0. No public exploit code has been released, but the vulnerability is exploitable over the network once a valid user session is established.
Affected Products — MLflow (open‑source tracking server) – all versions prior to 3.16.0.
Why It Matters for Trust & Control Assurance — The issue demonstrates a gap in the access‑control control objective; organizations must prove that every privileged operation is gated by proper authorization checks to satisfy frameworks such as NIST CSF 2.0.
Recommended Actions —
- Upgrade all MLflow Tracking Server instances to 3.16.0 or later.
- Review code and configuration for any other endpoints lacking authorization checks.
- Conduct an internal access‑control audit and capture evidence of remediation for audit readiness.
Source: ZDI Advisory