Mlflow CVE-2026-33866

This vulnerability presents moderate real-world risk with competing signals. The CVSS v4.0 score of 5.3 reflects network-accessible attack vector (AV:N), low complexity (AC:L), and low confidentiality impact (VC:L), but requires authenticated access (PR:L)-limiting the threat model to insider actors or compromised credentials. CISA SSVC decision framework classifies exploitation status as 'none' (no confirmed active exploitation) but marks the attack as 'automatable' (yes), suggesting trivial scripting required for systematic artifact exfiltration once credentials are obtained. The discrepancy between CVSS scoring and SSVC classification indicates this is a privilege-escalation or lateral-movement vector rather than a remote code execution or system compromise threat. Organizations with strong authentication hygiene and limited MLflow user populations face lower risk; those with many users or shared credentials face elevated insider-threat exposure. The availability of an upstream patch (GitHub PR #21708) further reduces urgency but does not eliminate the risk window for unpatched deployments.

A malicious or disgruntled MLflow user with valid credentials obtains the experiment ID of a competing team's proprietary ML model (e.g., via metadata leakage or social engineering). The attacker scripts a series of HTTP POST requests to the AJAX download endpoint with their own credentials but targeting the foreign experiment ID, bypassing the authorization check and retrieving the model artifacts without triggering audit alerts. This enables intellectual property theft or data exfiltration within a shared MLflow infrastructure environment. No public exploit code has been independently confirmed, but the attack requires only basic HTTP scripting knowledge and is fully automatable.