Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.0

MLflow multipart upload can be overwritten by others

CVE-2026-2651 · published 5 months ago
Summary

MLflow versions up to 3.10.1.dev0 let users replace files uploaded through certain API calls when running with the "--serve-artifacts" option. An attacker could change another user's model files, potentially inserting malicious code. Upgrade MLflow to version 3.10.0 or later to restore proper permission checks.

What to do
  • Update mlflow to version 3.11.1.
  • Update databricks mlflow to version 3.11.0rc1.
  • Update mlflow to version 3.10.0.
  • Update mlflow mlflow/mlflow to version 3.10.0 or later.
Affected software
Ecosystem VendorProductAffected versions
Bitnami – mlflow < 3.11.1
Fix: upgrade to 3.11.1
pip databricks mlflow < 3.11.0rc0
Fix: upgrade to 3.11.0rc1
– mlflow mlflow/mlflow < 3.10.0
– lfprojects mlflow <= 3.10.1
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
pip – mlflow < 3.10.0
Fix: upgrade to 3.10.0
Original advisory text
Missing Authorization Validation in mlflow/mlflow
A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
CWE-1220Insufficient Granularity of Access Control
Timeline
Published25 May 2026
Updated4 Nov 2026
First seen29 Jun 2026
Sources
BIT-mlflow-2026-2651 · OSV
CVE-2026-2651 · NVD
GHSA-8c7q-86fq-vvmh · GHSA
CVE-2026-2651 · MITRE
CVE-2026-2651 · OSV
Track software like this
Free during beta