https://vulnerability.circl.lu/sightings/feed 2026-08-22T16:45:18.339563+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/512c2c56-2a81-4c49-ac80-689cbd1ae237/export 2026-08-22T16:45:18.360178+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "512c2c56-2a81-4c49-ac80-689cbd1ae237", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69146", "type": "seen", "source": "https://bsky.app/profile/checkmarxzero.bsky.social/post/3mtji4yxyoj2w", "content": "\ud83d\udea8 CVE-2026-64849 is a critical unauthenticated SSRF discovered in MLflow.\n\nIt lets attackers reach internal services and potentially steal sensitive data.\n\nUpgrade to version 3.15.0 as it also fixes two additional flaws affecting MLflow, CVE-2026-69148 and CVE-2026-69146. \n\nDetails: buff.ly/Gjg9jor", "creation_timestamp": "2026-08-20T14:42:04.705389Z"} 2026-08-20T14:42:04.705389+00:00 https://vulnerability.circl.lu/sighting/7471fc04-fa73-4bfc-82c1-2afabda86853/export 2026-08-22T16:45:18.364469+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "7471fc04-fa73-4bfc-82c1-2afabda86853", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69146", "type": "seen", "source": "https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a", "content": "# CVE-2026-69146: CVE-2026-69146: Missing Authorization Bypass in MLflow Basic Authentication Middleware\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69146\n\n## Summary\nThis technical report details a missing authorization vulnerability (CVE-2026-69146 / GHSA-3p64-6gvh-82v5) affecting the MLflow platform from version 3.13.0 to 3.15.0. When MLflow is configured with the built-in basic-auth plugin, authenticated users can bypass run-level UPDATE authorization checks, enabling unauthorized dataset and model lineage metadata injection.\n\n## TL;DR\nAn authorization bypass vulnerability in MLflow's basic-auth middleware allows authenticated users to inject arbitrary dataset records into other users' runs without UPDATE permissions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 6.5\n- **EPSS Status**: Not Populated\n- **Impact**: High Integrity (I:H)\n- **Exploit Status**: POC / Test-Suite Verified\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- MLflow Platform Tracking Server\n- **MLflow**: >= 3.13.0, < 3.15.0 (Fixed in: `3.15.0`)\n\n## Mitigation\n\n- Upgrade to MLflow version 3.15.0 or later to integrate LogInputs and LogOutputs with the tracking server access control middleware.\n- Implement network boundary controls to limit access to the MLflow tracking port.\n- Apply reverse proxy or API gateway rules to filter and deny untrusted external traffic to the log-inputs and log-outputs REST endpoints.\n\n**Remediation Steps:**\n1. Verify the current MLflow version using package management tools or API server banners.\n2. Upgrade MLflow installations via 'pip install --upgrade mlflow>=3.15.0' or rebuild target containers using the updated image base.\n3. Ensure MLflow tracking servers are configured behind a web application firewall or reverse proxy.\n4. Configure log alerting for HTTP POST requests directed to /api/2.0/mlflow/runs/log-inputs originating from unexpected source networks.\n\n## References\n\n- [NVD CVE-2026-69146 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-69146)\n- [GitHub Security Advisory GHSA-3p64-6gvh-82v5](https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5)\n- [MLflow Security Fix Pull Request #24291](https://github.com/mlflow/mlflow/pull/24291)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69146) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-18T00:01:16.074427Z"} 2026-08-18T00:01:16.074427+00:00 https://vulnerability.circl.lu/sighting/6178e698-5390-4798-a551-d0c7f37420c0/export 2026-08-22T16:45:18.364588+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "6178e698-5390-4798-a551-d0c7f37420c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-69146", "type": "seen", "source": "https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a", "content": "# CVE-2026-69146: CVE-2026-69146: Missing Authorization Bypass in MLflow Basic Authentication Middleware\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-08-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-69146\n\n## Summary\nThis technical report details a missing authorization vulnerability (CVE-2026-69146 / GHSA-3p64-6gvh-82v5) affecting the MLflow platform from version 3.13.0 to 3.15.0. When MLflow is configured with the built-in basic-auth plugin, authenticated users can bypass run-level UPDATE authorization checks, enabling unauthorized dataset and model lineage metadata injection.\n\n## TL;DR\nAn authorization bypass vulnerability in MLflow's basic-auth middleware allows authenticated users to inject arbitrary dataset records into other users' runs without UPDATE permissions.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS**: 6.5\n- **EPSS Status**: Not Populated\n- **Impact**: High Integrity (I:H)\n- **Exploit Status**: POC / Test-Suite Verified\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- MLflow Platform Tracking Server\n- **MLflow**: >= 3.13.0, < 3.15.0 (Fixed in: `3.15.0`)\n\n## Mitigation\n\n- Upgrade to MLflow version 3.15.0 or later to integrate LogInputs and LogOutputs with the tracking server access control middleware.\n- Implement network boundary controls to limit access to the MLflow tracking port.\n- Apply reverse proxy or API gateway rules to filter and deny untrusted external traffic to the log-inputs and log-outputs REST endpoints.\n\n**Remediation Steps:**\n1. Verify the current MLflow version using package management tools or API server banners.\n2. Upgrade MLflow installations via 'pip install --upgrade mlflow>=3.15.0' or rebuild target containers using the updated image base.\n3. Ensure MLflow tracking servers are configured behind a web application firewall or reverse proxy.\n4. Configure log alerting for HTTP POST requests directed to /api/2.0/mlflow/runs/log-inputs originating from unexpected source networks.\n\n## References\n\n- [NVD CVE-2026-69146 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-69146)\n- [GitHub Security Advisory GHSA-3p64-6gvh-82v5](https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5)\n- [MLflow Security Fix Pull Request #24291](https://github.com/mlflow/mlflow/pull/24291)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-69146) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-17T23:31:40.103609Z"} 2026-08-17T23:31:40.103609+00:00 https://vulnerability.circl.lu/sighting/546988e9-5d35-47ae-8978-571d17630a45/export 2026-08-22T16:45:18.364667+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "546988e9-5d35-47ae-8978-571d17630a45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-69146", "type": "published-proof-of-concept", "source": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5", "content": "", "creation_timestamp": "2026-08-17T22:35:05.877021Z"} 2026-08-17T22:35:05.877021+00:00