MLflow Tracking Server Vulnerable to Information Disclosure
A vulnerability in MLflow Tracking Server allows authenticated remote attackers to disclose sensitive information due to missing authorization checks.
The MLflow Tracking Server, a popular open-source platform for managing the machine learning lifecycle, has been found to contain a critical information disclosure vulnerability. Identified as ZDI-26-840 and assigned CVE-2026-118624, the flaw allows authenticated remote attackers to access sensitive data.
The vulnerability stems from a lack of proper authorization checks within the _find_validator function. This oversight permits an attacker, who has already gained authenticated access to the system, to bypass intended access controls and retrieve information that should remain confidential. The exploitation requires prior authentication, limiting the direct attack surface but still posing a significant risk to installations where unauthorized access to an authenticated session is possible.
Exploitation of this vulnerability could lead to the disclosure of sensitive information within the context of the service account running MLflow. The specific nature of the disclosed information is not detailed in the advisory, but it could potentially include configuration details, internal system paths, or other operational data that could be leveraged in further attacks.
The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a score of 5.4, categorizing it as Medium severity. While not reaching the 'Critical' threshold, this score indicates a notable risk that warrants prompt attention from administrators and security teams managing MLflow deployments.
This vulnerability impacts all installations of MLflow prior to version 3.16.0. The issue was reported to the vendor on June 18, 2026, and a coordinated public release of the advisory occurred on October 29, 2026. The MLflow development team has since addressed the vulnerability.
MLflow version 3.16.0, released on October 29, 2026, includes a fix for this vulnerability. The specific pull request addressing the issue is #25069. Users are strongly advised to update to this latest version to mitigate the risk of information disclosure.
This disclosure was credited to Grigory Dorodnov of TrendAI Research. The Zero Day Initiative (ZDI) coordinated the release of this advisory, highlighting the ongoing efforts by security researchers to identify and report vulnerabilities in widely used software.
Organizations utilizing MLflow should prioritize updating their installations to the patched version. In environments where immediate patching is not feasible, administrators should review access controls and monitor for any suspicious activity related to authenticated user sessions within the MLflow Tracking Server.
The newly disclosed ZDI-26-842 advisory details a distinct privilege escalation vulnerability within MLflow Tracking Server, separate from the previously reported information disclosure. This new flaw, CVE-2026-118626, specifically targets the server's BEFORE_REQUEST_HANDLERS configuration, allowing authenticated remote attackers to escalate privileges to protected resources. The vulnerability has been fixed in MLflow version 3.16.0.
This new advisory, ZDI-26-841, details a distinct privilege escalation vulnerability (CVE-2026-118625) within the MLflow Tracking Server's get_endpoints function. Unlike the previously reported information disclosure flaw, this vulnerability requires authentication and allows remote attackers to escalate privileges to protected resources, carrying a CVSS score of 6.3.
This new advisory, ZDI-26-844, details a Server-Side Request Forgery (SSRF) vulnerability in MLflow's get-artifacts function, assigned CVE-2026-118628. Unlike the previously reported vulnerability which required authentication, this SSRF flaw allows unauthenticated remote attackers to disclose sensitive information by exploiting improper URI validation. The Zero Day Initiative has assigned this vulnerability a CVSS score of 8.2, emphasizing its critical nature.