All vulnerabilities
CVE-2026-2651BIT-mlflow-2026-2651GHSA-8c7q-86fq-vvmhPYSEC-2026-2220

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

mlflow mlflowpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.0Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 26 May 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.54%Chance of exploitation activity in the next 30 days, higher than 44% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.10.0Fixed versionGitHub
Published25 May 2026Updated 6 Oct 2026CVE List

What fixes it

  • 3.10.0mlflow, pipGitHub
  • 3.10.0mlflow/mlflowCVE List
  • 3.10.0mlflow, PyPIOSVpip install "mlflow>=3.10.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/* endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.

Text from CVE List

Affected versions 53

  • mlflow, pip< 3.10.0GitHub
  • mlflow/mlflowaffected: unspecified before 3.10.0CVE List
  • mlflow, PyPIfrom first release, fixed in 3.10.0OSV
  • mlflow, PyPI0.0.1OSV
  • mlflow, PyPI0.1.0OSV
  • mlflow, PyPI0.2.0OSV
  • mlflow, PyPI0.2.1OSV
  • mlflow, PyPI0.3.0OSV
  • mlflow, PyPI0.4.0OSV
  • mlflow, PyPI0.4.1OSV
  • mlflow, PyPI0.4.2OSV
  • mlflow, PyPI0.5.0OSV
  • mlflow, PyPI0.5.1OSV
  • mlflow, PyPI0.5.2OSV
  • mlflow, PyPI0.6.0OSV
  • mlflow, PyPI0.7.0OSV
  • mlflow, PyPI0.8.0OSV
  • mlflow, PyPI0.8.1OSV
  • mlflow, PyPI0.8.2OSV
  • mlflow, PyPI0.9.0OSV
  • mlflow, PyPI0.9.0.1OSV
  • mlflow, PyPI0.9.1OSV
  • mlflow, PyPI1.0.0OSV
  • mlflow, PyPI1.1.0OSV
  • mlflow, PyPI1.1.1.dev0OSV
  • mlflow, PyPI1.10.0OSV
  • mlflow, PyPI1.11.0OSV
  • mlflow, PyPI1.12.0OSV
  • mlflow, PyPI1.12.1OSV
  • mlflow, PyPI1.13OSV
  • mlflow, PyPI1.13.1OSV
  • mlflow, PyPI1.14.0OSV
  • mlflow, PyPI1.14.1OSV
  • mlflow, PyPI1.15.0OSV
  • mlflow, PyPI1.16.0OSV
  • mlflow, PyPI1.17.0OSV
  • mlflow, PyPI1.18.0OSV
  • mlflow, PyPI1.19.0OSV
  • mlflow, PyPI1.2.0OSV
  • mlflow, PyPI1.20.0OSV
  • mlflow, PyPI1.20.1OSV
  • mlflow, PyPI1.20.2OSV
  • mlflow, PyPI1.21.0OSV
  • mlflow, PyPI1.22.0OSV
  • mlflow, PyPI1.23.0OSV
  • mlflow, PyPI1.23.1OSV
  • mlflow, PyPI1.24.0OSV
  • mlflow, PyPI1.25.0OSV
  • mlflow, PyPI1.25.1OSV
  • mlflow, PyPI1.26.0OSV
  • mlflow, PyPI1.26.1OSV
  • mlflow, PyPI1.27.0OSV
  • mlflow, PyPI1.28.0OSV

References 8