MLflow: MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts`…
MLflow
More for MLflow RSS feed for MLflow
- Severity
- Critical, CVSS 9.0
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
- Record
- CVE-2026-2651
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 25, 2026
- Source last modified
- October 6, 2026
Description
A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/* endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.
Description quoted from the NVD record.
Who is affected
MLflow, made by LF Projects, is a platform teams use to track, store and share machine learning models. This flaw affects MLflow versions up to and including 3.10.1.dev0 when the server is set up to store and serve model files for its users. The part that handles uploading large files in pieces does not check whether a person has permission to change a given file. An attacker could overwrite models and other files belonging to other users, tamper with models your team relies on, and run harmful code on any machine that later loads a tampered model. This flaw is rated Critical.
What to do
- The person who installed or runs MLflow for your organization should handle this. If an IT provider or vendor manages it for you, send them this advisory and ask when the update will be done.
- Find out which MLflow version you run and whether the server is set up to store and serve model files for users.
- Update MLflow to version
3.10.0or later, the release named as fixing this flaw. Because the affected versions named for this flaw run up to3.10.1.dev0, check the vendor advisory linked on this page to confirm the right release. - After updating, have your team check that the models they rely on have not been changed unexpectedly before loading them again.
Analysis written from the source record as of October 6, 2026 and reviewed before publishing.