PkgSeer

Vulnerability GHSA-8c7q-86fq-vvmh

Critical

4 months ago

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

0.0.1 - 3.10.0rc0

Summary

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

Details

A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/* endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

MLflow AI Gateway permits SSRF through an unvalidated api_base

3.13.0 - 3.15.2 PYSEC-2026-3865

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

2.1.0 - 2.11.4 and 2.12.0 - 2.13.2 and 2.14.0rc0 - 3.14.0 GHSA-gqvg-gmmx-x4hm

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

0.0.1 - 2.11.4 and 2.12.0 - 2.13.2 and 2.14.0rc0 - 3.14.0 PYSEC-2026-3687

MLflow: trace API endpoints lack proper authorization validators

2.14.0rc0 - 3.12.0 PYSEC-2026-3686

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

3.3.0 - 3.14.0 GHSA-7gwp-5pfp-969j

View all vulnerabilities for these packages

Impacted packages

mlflow

Timeline

Published

4 months ago

Fixed (3.10.0)

7 months ago

Last Modified

6 hours ago