Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
•added 2026/08/17 9:59 p.m.•17 views

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary When MLflow is deployed with the built-in basic-auth plugin --app-name basic-auth, any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map ...

6.5CVSS5.6AI score0.00389EPSS
SaveExploits0References5Affected Software1
Rows per page
Query Builder