CVE-2026-118624

MediumCVSS 5.4/10Last modified Nov 4, 2026

Description

MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability.

The specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-862

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 4, 2026
Last modified: Nov 4, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1186256.3MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate priv CVE-2026-1186265.4MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escala CVE-2026-1186277.8MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers CVE-2026-1186288.2MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclos CVE-2026-1186295.3The All-in-One Video Gallery WordPress plugin before 5.0.0 does not check a video's publication status before rendering it on its player pa CVE-2026-1186313.8Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on CVE-2026-1186328.0Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute ar CVE-2026-1186338.1A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after CVE-2026-1186346.4The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and CVE-2026-1186356.5The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortc CVE-2026-1186369.8**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes wi CVE-2026-1186372.7The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its sho