CVE-2026-118625

MLflow Tracking Server can execute a handler during its permission check

MLflow · Tracking Server basic-auth request dispatch

First documented disclosure · Review checkpoint

Summary

An authenticated non-admin request can execute a handler twice, creating duplicate runs or jobs.

Severity and exploitation evidence

Medium · 6.3/10 · CVSS 3.0. Severity source.

Exploitation not established: MLflow reproduced duplicate runs in a controlled non-admin test. The reviewed sources identify no malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The endpoint table includes application view functions where basic-auth expects permission validators. Calling a view during authorization triggers side effects before the normal dispatch.

Conditions required

A valid non-admin account, basic-auth enabled and a request to an affected explicit endpoint, such as issue-detection invocation.

Potential impact

MLflow reproduced two runs from one request. ZDI additionally assesses access to protected functionality. The linked fix does not establish which additional resources an attacker could reach.

Affected versions and configurations

ZDI identifies MLflow 3.14.0 as affected. The CNA does not specify the full vulnerable range.

Fix and mitigation status

ZDI lists 3.16.0. The specific validator filter from PR 24354 is also present in the 3.15.0 source tag. The earliest packaged fix was not established.

Practical next steps

Upgrade to a supported build containing the before-request validator fix. Check for duplicate jobs or runs and verify a single invocation creates only the expected work.

Operating lesson

Keep permission checks free of side effects and keep request handlers out of the validator table.

Evidence and limits

The June 22 issue and July 8 PR describe a separate after-request error. July 10 is the first reviewed public explanation of the before-request mechanism. ZDI’s 3.16.0 fix attribution and earlier tagged code are both preserved. The public project change predates the October 29 ZDI advisory and November 3 CNA record.

Sources