Privilege Escalation Vulnerability in MLflow Tracking Server

CVE-2026-118626

What is CVE-2026-118626?

The MLflow Tracking Server is susceptible to a privilege escalation vulnerability due to improper configuration of the BEFORE_REQUEST_HANDLERS. This flaw allows authenticated remote attackers to gain access to restricted functionalities, effectively escalating their privileges and gaining access to resources that should remain protected. Mitigation strategies should include patching affected installations and reviewing authorization configurations to enhance the security posture.

References