EUVD-2026-60474
GHSA-gqch-g4w5-7qcw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-accessible logic flaw requiring a low-privilege authenticated account (PR:L); high confidentiality impact from unrestricted cross-user artifact reads; low integrity from spurious model version creation; no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0.
AnalysisAI
MLflow's CreateModelVersion endpoint prior to version 3.15.0 permits authenticated users to anchor a model version to another user's run or logged-model artifact directory, then retrieve those artifacts through GET /model-versions/get-artifact without holding the required READ permission on the source resource. This confused-deputy pattern arises because _validate_source_run() and _validate_source_model() in mlflow/server/handlers.py enforce only path containment - not cross-user authorization - allowing the registered model's artifact-read gate to be used as a proxy to exfiltrate a victim's ML artifacts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated account on the target MLflow server with at least UPDATE/EDIT permission on one registered model (to invoke `CreateModelVersion`). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) accurately reflects the real-world risk profile: network-accessible exploitation with low complexity, requiring only a valid authenticated account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated MLflow user on a shared multi-tenant instance calls `POST /api/2.0/mlflow/model-versions/create` supplying a `run_id` belonging to a co-tenant (obtained through experiment search or out-of-band knowledge) and a `source` path pointing into that run's artifact directory. The path containment check passes, the model version is created under the attacker's own registered model, and the attacker then calls `GET /model-versions/get-artifact` against their own model version to retrieve the victim's trained model weights, datasets, or other logged artifacts without ever holding READ permission on the source run. … |
| Remediation | The primary remediation is to upgrade to MLflow 3.15.0, which enforces READ permission on the source `run_id` or `model_id` at model version creation time via the new `validate_can_create_model_version()` authorization function. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all MLflow deployments and identify which systems run versions prior to 3.15.0. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today