Privilege Escalation in MLflow Tracking Server (CVE‑2026‑118626) Bypasses Authorization Controls
What It Is — The Zero Day Initiative advisory ZDI‑26‑842 (CVE‑2026‑118626) describes a privilege‑escalation flaw in the MLflow Tracking Server. The defect resides in the BEFORE_REQUEST_HANDLERS configuration, where the server fails to enforce authorization before invoking internal handlers. An authenticated remote attacker can invoke these handlers to gain access to resources normally restricted to higher‑privilege users. The vulnerability carries a CVSS v3.1 base score of 5.4 (moderate) with network‑accessible vector, low attack complexity, and impacts confidentiality and integrity. MLflow released a fix in version 3.16.0 (see the GitHub pull request #25067).
Affected Products — MLflow (all versions prior to 3.16.0).
Why It Matters for Trust & Control Assurance — The issue highlights the need for robust authorization controls that enforce least‑privilege access to critical functions. Verisq’s Access Controls capability helps you continuously verify that such controls are in place and auditable.
Recommended Actions
- Upgrade all MLflow Tracking Server instances to 3.16.0 or later.
- Review and harden
BEFORE_REQUEST_HANDLERSconfigurations to ensure explicit authorization checks. - Conduct an internal penetration test focused on privilege‑escalation paths.
- Document the change in your change‑management and audit logs as evidence of control remediation.
Source: Zero Day Initiative Advisory