EUVD-2026-19609
GHSA-46r5-x6jq-v8g6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access.
This issue affects MLflow version through 3.10.1
AnalysisAI
MLflow through version 3.10.1 allows authenticated users to bypass authorization controls and download model artifacts from experiments they lack permission to access via an unprotected AJAX endpoint. The vulnerability requires valid MLflow authentication but no special privileges, enabling lateral access to restricted experiment data. Patch availability confirmed via upstream pull request; CISA SSVC assessment indicates partial technical impact with automatable exploitation path but no confirmed active exploitation.
Technical ContextAI
MLflow is an open-source machine learning platform for experiment tracking and model management. The vulnerability exists in the AJAX endpoint responsible for downloading saved model artifacts-a REST-based interface commonly used for programmatic artifact retrieval. The root cause is missing access-control validation (CWE-862: Improper Authorization), meaning the endpoint fails to verify whether the requesting authenticated user has read permissions on the target experiment before serving artifacts. Any authenticated MLflow user can construct requests to this endpoint specifying arbitrary experiment identifiers, bypassing the authorization model that normally restricts artifact visibility to authorized personnel. The affected scope spans MLflow versions 0 through 3.10.1 across all platform instances where the software is deployed (cpe:2.3:a:mlflow:mlflow:*:*:*:*:*:*:*:*).
RemediationAI
Upgrade MLflow to the patched version released after 3.10.1; exact fix version designation should be confirmed from the upstream pull request at https://github.com/mlflow/mlflow/pull/21708 and corresponding tagged release. Until patching is feasible, restrict MLflow API endpoint access via network-layer controls (firewall rules, reverse-proxy authentication) to limit authenticated user access, and audit access logs for suspicious cross-experiment artifact downloads. Organizations should review deployed MLflow instances for version compliance and prioritize upgrades given the simple automatable exploitation path and confirmed authorization bypass. Vendor advisory details are available from CERT-PL at https://cert.pl/en/posts/2026/04/CVE-2026-33865/.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today