MLflow EUVD-2026-31642

The MLflow tracking server must be started with the --serve-artifacts flag AND have the built-in authentication module enabled to create a multi-user authorization boundary worth bypassing; the attacker must hold valid credentials for any low-privilege account on that server (PR:L), must know or guess the target experiment ID and artifact path to overwrite, and must wait for a victim user or automation pipeline to load the poisoned model (UI:R) before arbitrary code execution materializes. Single-user MLflow installs, deployments that do not enable --serve-artifacts, and deployments fronted by an external authorization proxy that enforces per-experiment ACLs on /mlflow-artifacts/mpu/* are not exploitable.

The CVSS 9.0 score is driven by network attack vector, low complexity, scope change (one user's credentials affect another user's resources), and total CIA impact, which together describe a realistic cross-tenant compromise on a multi-user MLflow deployment. However, several signals temper the urgency: PR:L means an attacker must already hold a valid MLflow account, UI:R requires that a victim eventually load the poisoned model for code execution to land, and the deployment must actually run with --serve-artifacts and the built-in auth plugin enabled - a non-default combination. EPSS at 0.05% and SSVC Automatable:no indicate the issue is not suited to mass scanning, and there is no CISA KEV listing, so the realistic threat is targeted abuse inside shared ML platforms rather than internet-wide exploitation. Note one data inconsistency worth verifying with the vendor: the description states the issue is resolved in 3.10.0 while also citing affected versions <=3.10.1.dev0 - EUVD aligns with the <3.10.0 boundary, so 3.10.0 should be treated as the fixed line.

An attacker with a low-privilege account on a shared MLflow tracking server running --serve-artifacts issues a POST to /api/2.0/mlflow-artifacts/mpu/create/{victim_experiment_id}/artifacts/model with a path such as python_model.pkl, then completes the multipart upload to overwrite a colleague's registered model with a malicious pickle payload. When a data scientist or CI pipeline subsequently calls mlflow.pyfunc.load_model on that model, the pickle deserializes and executes the attacker's code in the victim's context - a public proof-of-concept demonstrating the 403-bypass on these MPU routes is referenced in the huntr report.