{"id":"EM-20261103-UZ0V","url":"https://cyber.eventmonitor.net/incident/EM-20261103-UZ0V/","type":"cve","title":"MLflow Tracking Server Issues Missing Authorization Vulnerability (CVE-2026-118626)","subtitle":"CVE-2026-118626","subject":"CVE-2026-118626","status":"Developing","severity":"medium","affected":[],"headline":null,"born":"2026-11-03T23:45:50.000Z","firstSignal":"2026-10-29T05:00:00.000Z","lastSignal":"2026-11-03T23:45:50.000Z","updated":"2026-11-04T14:43:58.877Z","revision":1,"life":[{"status":"Born","at":"2026-11-03T23:45:50.000Z","why":"second independent source: C41 Red Hat Security Data"},{"status":"Developing","at":"2026-11-03T23:45:50.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-10-29T05:00:00.000Z","what":"First signal: C37 Zero Day Initiative (published)"},{"at":"2026-11-03T23:45:50.000Z","what":"Born: second source, C41 Red Hat Security Data. Page EM-20261103-UZ0V created."}],"stages":[{"name":"Disclosed","at":"2026-11-04T00:17:23.737Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-04T00:17:23.737Z","detail":"CVSS 5.4 · EPSS 0.2%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-03T23:45:50.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-10-29T05:00:00.000Z","source":"C37","sourceName":"Zero Day Initiative (published)","role":"Research & News","severity":2,"title":"ZDI-26-842: MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability","text":"This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4. The following CVEs are assigned: CVE-2026-118626.","url":"http://www.zerodayinitiative.com/advisories/ZDI-26-842/"},{"at":"2026-11-03T23:45:50.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":2,"title":"Red Hat: CVE-2026-118626 (moderate)","text":"mlflow: mlflow: Privilege escalation via missing authorization in request handlers","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-118626.json"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-04T00:17:23.737","score":5.4,"severity":"MEDIUM","desc":"MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the configuration ","product":"","seen":1793803438877},"kev":null,"epss":{"epss":0.00225,"pct":0.13268,"at":1793803438877},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}