Mlflow EUVD-2026-19608

Although the CVSS score of 5.1 appears low-to-moderate, multiple signals confirm this is a legitimate insider threat requiring active response. The CVSS vector shows PR:L (authenticated attacker required) and UI:P (user interaction required), which correctly constrains the attack surface to already-authenticated MLflow users and victims who must view the poisoned artifact. The SSVC framework corroborates this: exploitation is rated 'none' (not currently being exploited), automatable is 'no' (requires manual upload and victim interaction), and technical impact is 'partial' (affects confidentiality and integrity, not availability). However, the stored nature of the XSS is significant-once uploaded, the payload persists and affects all users who view that artifact, making it a supply-chain-like threat within team environments. The VI (Integrity) impact in CVSS confirms that victim actions can be impersonated. For organizations where MLflow users collaborate on model artifacts, this warrants prioritized patching despite the modest CVSS score.

An authenticated MLflow user (e.g., a disgruntled team member or compromised account) uploads a specially crafted MLmodel file with a malicious JavaScript payload embedded in a YAML field. When a second user with administrative or model review privileges opens the artifacts page to inspect model metadata, the injected script executes in their browser session, stealing their authentication token or triggering a model deployment under the victim's identity. The attack requires network access to MLflow's web interface (satisfied in most cloud or on-premise deployments) but low privileges (ordinary authenticated user) and user interaction (clicking on the artifact), making it a plausible insider threat or post-compromise lateral-movement technique.