{"id":"EM-20261103-O25T","url":"https://cyber.eventmonitor.net/incident/EM-20261103-O25T/","type":"cve","title":"MLflow Tracking Server Missing Authorization Privilege Vulnerability (CVE-2026-118625)","subtitle":"CVE-2026-118625","subject":"CVE-2026-118625","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-03T23:45:41.000Z","firstSignal":"2026-10-29T05:00:00.000Z","lastSignal":"2026-11-03T23:45:41.000Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-11-03T23:45:41.000Z","why":"second independent source: C41 Red Hat Security Data"},{"status":"Developing","at":"2026-11-03T23:45:41.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T05:00:00.000Z","what":"First signal: C37 Zero Day Initiative (published)"},{"at":"2026-11-03T23:45:41.000Z","what":"Born: second source, C41 Red Hat Security Data. Page EM-20261103-O25T created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T00:17:23.580Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T00:17:23.580Z","detail":"CVSS 6.3 · EPSS 0.3%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-03T23:45:41.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T05:00:00.000Z","source":"C37","sourceName":"Zero Day Initiative (published)","role":"Research & News","severity":2,"title":"ZDI-26-841: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability","text":"This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3. The following CVEs are assigned: CVE-2026-118625.","url":"http://www.zerodayinitiative.com/advisories/ZDI-26-841/"},{"at":"2026-11-03T23:45:41.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-118625 (moderate)","text":"mlflow: mlflow: Privilege escalation via missing authorization in get_endpoints","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-118625.json"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T00:17:23.580","score":6.3,"severity":"MEDIUM","desc":"MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the get_endpoints functio","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00251,"pct":0.16606,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}