CVE-2026-64849

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original U...

GHSA-GQCH-G4W5-7QCW MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

Summary The validatesourcerun and validatesourcemodel functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated...

MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

Summary The validatesourcerun and validatesourcemodel functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated...

Missing Authorization

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Missing Authorization via the CreateModelVersion endpoint, which...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +74 more potentially affected by CVE-2026-69148 via mlflow (>=3.0.0rc2, <=3.14.0)

mlflow PYPI version =3.0.0rc2, =1.0.0, =0.3.1, =1.1.0b1, =0.0.1, =1.0.17.1, =1.23.0, =0.3.0, =0.1.0, =0.1.0, =0.0.1rc1, =0.0.1 and more Source cves: CVE-2026-69148 Source advisory: SNYK:PYTHON-MLFLOW-18912230...

NPM: MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

NPM: MLflow: CreateModelVersion source validation does not check READ permission on referenced runid vulnerability discovered by ? in WordPress Npm mlflow versions 3.15.0...

NPM: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

NPM: MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth vulnerability discovered by ? in WordPress Npm mlflow versions 3.15.0...

GHSA-3P64-6GVH-82V5 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary When MLflow is deployed with the built-in basic-auth plugin --app-name basic-auth, any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map ...

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary When MLflow is deployed with the built-in basic-auth plugin --app-name basic-auth, any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map ...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +74 more potentially affected by CVE-2026-69146 via mlflow (>=3.0.0rc2, <=3.14.0)

mlflow PYPI version =3.0.0rc2, =1.0.0, =0.3.1, =1.1.0b1, =0.0.1, =1.0.17.1, =1.23.0, =0.3.0, =0.1.0, =0.1.0, =0.0.1rc1, =0.0.1 and more Source cves: CVE-2026-69146 Source advisory: SNYK:PYTHON-MLFLOW-18912236...

Missing Authorization

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Missing Authorization via the LogInputs and LogOutputs endpoints,...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +49 more potentially affected by CVE-2026-64849 via mlflow (>=3.3.0, <=3.14.0)

mlflow PYPI version =3.3.0, =1.0.0, =0.4.0, =0.3.0, =0.1.0, =0.8.0, =0.8.0, =0.5.0.0, =0.5.0, =0.9.6, =0.9.7 and more Source cves: CVE-2026-64849 Source advisory: GHSA-7GWP-5PFP-969J...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +74 more potentially affected by CVE-2026-64849 via mlflow (>=3.0.0rc2, <=3.14.0)

mlflow PYPI version =3.0.0rc2, =1.0.0, =0.3.1, =1.1.0b1, =0.0.1, =1.0.17.1, =1.23.0, =0.3.0, =0.1.0, =0.1.0, =0.0.1rc1, =0.0.1 and more Source cves: CVE-2026-64849 Source advisory: SNYK:PYTHON-MLFLOW-18912142...

GHSA-7GWP-5PFP-969J MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

Server-side Request Forgery (SSRF)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via a DNS rebinding attack agains...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +49 more potentially affected by CVE-2026-64849 via mlflow (>=3.3.0, <=3.14.0)

mlflow PYPI version =3.3.0, =1.0.0, =0.4.0, =0.3.0, =0.1.0, =0.8.0, =0.8.0, =0.5.0.0, =0.5.0, =0.9.6, =0.9.7 and more Source cves: CVE-2026-64849 Source advisory: OSV:GHSA-7GWP-5PFP-969J...

CVE-2026-69146 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFOREREQUESTHANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs...

fastmonai (>=0.9.1, <=0.9.2), fleet-rlm (>=0.6.0, <=0.6.2) +2 more potentially affected by CVE-2026-69146 via mlflow (3.14.0)

mlflow PYPI version 3.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - fastmonai =0.9.1, =0.6.0, =1.4.0, =1.5.0 - sm-data-ml-utils 1.0.9 Source cves: CVE-2026-69146 Source advisory: MEND:CVE-2026-69146...

EUVD-2026-60475

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFOREREQUESTHANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs...