CVE-2026-118626

MLflow issue routes omit experiment permission checks

MLflow · Tracking Server experiment issues under basic-auth

First documented disclosure · Review checkpoint

Summary

A user can read, enumerate, create or modify issues on experiments they have no permission to access.

Severity and exploitation evidence

Medium · 5.4/10 · CVSS 3.0. Severity source.

Exploitation not established: The disclosure and project fix describe the weakness. The reviewed sources report no confirmed malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The issue routes lack validators for the owning experiment. Under fail-open basic-auth, successful login is sufficient to reach them.

Conditions required

A signed-in user on an affected basic-auth server and an experiment or issue identifier for the relevant operation.

Potential impact

Exposure and tampering of issue records belonging to other experiment owners.

Affected versions and configurations

ZDI identifies MLflow 3.14.0 as affected. The CNA does not specify the full vulnerable range.

Fix and mitigation status

ZDI identifies 3.16.0 as fixed for this issue.

Practical next steps

Use a supported version containing the 3.16.0 issue-route fix. Test cross-experiment issue lookup, search and update with an account that has no permissions on the target.

Operating lesson

Check the parent experiment’s permissions on collection routes as well as on individual records.

Evidence and limits

The issue-specific patch maps reads and searches to read permission and changes to update permission. Its shared tests also cover datasets, which are a separate route family. The public project change predates the October 29 ZDI advisory and November 3 CNA record.

Sources