{"id":"EM-20261103-M7YG","url":"https://cyber.eventmonitor.net/incident/EM-20261103-M7YG/","type":"cve","title":"MLflow Tracking Server Jobs Missing Authorization Vulnerability (CVE-2026-118624)","subtitle":"CVE-2026-118624","subject":"CVE-2026-118624","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-03T23:45:30.000Z","firstSignal":"2026-10-29T05:00:00.000Z","lastSignal":"2026-11-03T23:45:30.000Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-11-03T23:45:30.000Z","why":"second independent source: C41 Red Hat Security Data"},{"status":"Developing","at":"2026-11-03T23:45:30.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T05:00:00.000Z","what":"First signal: C37 Zero Day Initiative (published)"},{"at":"2026-11-03T23:45:30.000Z","what":"Born: second source, C41 Red Hat Security Data. Page EM-20261103-M7YG created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T00:17:23.423Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T00:17:23.423Z","detail":"CVSS 5.4 · EPSS 0.4%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-03T23:45:30.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T05:00:00.000Z","source":"C37","sourceName":"Zero Day Initiative (published)","role":"Research & News","severity":2,"title":"ZDI-26-840: MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability","text":"This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118624.","url":"http://www.zerodayinitiative.com/advisories/ZDI-26-840/"},{"at":"2026-11-03T23:45:30.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-118624 (moderate)","text":"mlflow: mlflow: Information disclosure via missing authorization in Tracking Server Jobs","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-118624.json"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T00:17:23.423","score":5.4,"severity":"MEDIUM","desc":"MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the _fi","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00365,"pct":0.30506,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}