Information Disclosure Vulnerability in MLflow Tracking Server
CVE-2026-118624

5.4MEDIUM

Key Information:

Vendor

Mlflow

Status
Mlflow
Vendor
CVE Published:
3 November 2026

What is CVE-2026-118624?

A vulnerability in the MLflow Tracking Server allows remote attackers to disclose sensitive information due to insufficient authorization checks in the _find_validator function. Exploiting this flaw requires authentication and can lead to unauthorized disclosure of information within the context of the service account, potentially compromising the integrity and confidentiality of data. It is vital for administrators of MLflow installations to review their configuration and implement necessary security measures to mitigate this risk.

Affected Version(s)

MLflow 3.13.0

References

https://www.zerodayinitiative.com/advisories/ZDI-26-840/
x_research-advisory

CVSS V3.0

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.