CVE-2026-118624

MLflow users can inspect or cancel another user’s tracking job

MLflow · Tracking Server jobs under basic-auth

First documented disclosure · Review checkpoint

Summary

A signed-in user can retrieve another user’s job parameters and results or stop that job.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.0. Severity source.

Exploitation not established: The disclosure and project fix describe the weakness. The reviewed sources report no confirmed malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The job lookup and cancellation routes lack a permission check. The job record has no owner for the server to compare with the requester.

Conditions required

A reachable Tracking Server using the affected fail-open basic-auth behavior, a valid user account and a target job ID.

Potential impact

Disclosure of another user’s job inputs or outputs and disruption of work through cancellation.

Affected versions and configurations

ZDI identifies MLflow 3.13.0 as affected. The CNA does not specify the full vulnerable range.

Fix and mitigation status

ZDI identifies 3.16.0 as fixed for this issue.

Practical next steps

Upgrade to a supported version containing the 3.16.0 fix and apply its jobs-table migration. Verify one non-admin user cannot retrieve or cancel another user’s job.

Operating lesson

Give asynchronous jobs an owner and check that owner on both status and cancel requests.

Evidence and limits

The patch limits access to the job creator or an administrator. After migration, non-admins cannot access legacy jobs without a recorded creator. The public project change predates the October 29 ZDI advisory and November 3 CNA record.

Sources