MLflow XSS and Authorization Bypass

MLflow through version 3.10.1 allows authenticated users to bypass authorization controls and download model artifacts from experiments they lack permission to access via an unprotected AJAX endpoint. The vulnerability requires valid MLflow authentication but no special privileges, enabling lateral access to restricted experiment data. Patch availability confirmed via upstream pull request; CISA SSVC assessment indicates partial technical impact with automatable exploitation path but no confirmed active exploitation.

Stored cross-site scripting (XSS) in MLflow through version 3.10.1 allows authenticated attackers to inject malicious payloads via YAML-based MLmodel artifacts that execute when other users view the artifact in the web interface, enabling session hijacking or unauthorized actions on behalf of victims. CVSS 5.1 reflects low severity due to authentication requirement and user interaction; SSVC framework rates exploitation as none, automatable as no, and technical impact as partial. Upstream fix is available in a GitHub PR, though no formally released patched version has been independently confirmed from provided data.