Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2 days ago8 views

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary When MLflow is deployed with the built-in basic-auth plugin --app-name basic-auth, any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map ...

6.5CVSS5.6AI score0.00221EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder