Mmastodon TechnologyCybersecurity first seen 2 d ago, last 2 d ago, peak #11

New MLflow vulnerability allows information disclosure, scored 5.4

Original: 🚨 EUVD-2026-116620 📊 Score: 5.4/10 (CVSS v3.1) 📦 Product: MLflow 🏢 Vendor: mlflow 📅 Updated: 2026-11-04 📝 MLflow Trackin

A medium-severity vulnerability, EUVD-2026-116620, has been catalogued in MLflow, the open-source machine learning platform. The flaw, rated 5.4 out of 10 under CVSS v3.1, lies in the MLflow Tracking Server's jobs feature, which fails to enforce authorization. It allows remote attackers to disclose sensitive information. The advisory record was updated on November 4, 2026.

Why now: Security teams tracking MLflow deployments are being alerted to a newly published advisory for an information disclosure flaw.

MLflowEUVD-2026-116620

Open on mastodon →

Evidence

• 🚨 EUVD-2026-116620 📊 Score: 5.4/10 (CVSS v3.1) 📦 Product: MLflow 🏢 Vendor: mlflow 📅 Updated: 2026-11-04 📝 MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/4815626