MLflow EUVD-2026-34245

Exploitation requires local host access to the system running MLflow (AV:L) - remote network exploitation is not possible. The attacker must hold at least low-privilege credentials on the local host (PR:L per CVSS vector). The vulnerability is limited to code paths that invoke mlflow.data.digest_utils functions (compute_pandas_digest, compute_numpy_digest, hash_dict_of_arrays), meaning the MLflow dataset tracking feature must be in use - MLflow deployments that do not log datasets are not exposed. High attack complexity (AC:H) is the primary limiting factor: crafting collision-inducing inputs against the specific digest schema requires expertise and effort. The vulnerability does not affect MLflow model serving, experiment tracking unrelated to datasets, or any network-facing interface.

The CVSS 4.0 score of 1.1 accurately reflects the narrow real-world risk profile. The attack vector is strictly local (AV:L), requires low privileges (PR:L), and carries high complexity (AC:H) - MD5 collision crafting against a specific dataset digest schema is non-trivial even with published tooling. Impact is limited to minor integrity and availability on the vulnerable component (VI:L/VA:L) with no confidentiality impact (VC:N) and no impact on subsequent system components (SC:N/SI:N/SA:N). EPSS data was not provided in the input, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV. The primary realistic threat is a malicious insider or compromised local user substituting a fraudulent dataset while evading MLflow's lineage tracking - a narrow scenario relevant mainly to ML pipeline integrity assurance contexts. The 'Information Disclosure' tag in source intelligence appears inconsistent with the CVSS VC:N rating and may reflect the broader CWE-327 classification rather than a direct confidentiality impact; this discrepancy should be verified with the vendor.

A locally authenticated MLflow user with low privileges crafts two distinct pandas DataFrames engineered to produce an identical 8-character MD5 digest by exploiting MD5 collision properties and the limited column type coverage in the original sampling logic. The attacker logs the benign dataset under a known run, then substitutes the malicious dataset with the same computed digest, bypassing MLflow's dataset integrity check. A proof-of-concept demonstrating this collision has been published, though the high attack complexity (AC:H) requires significant up-front effort to engineer the collision inputs.