{"id":"CVE-2026-2651","aliases":["BIT-mlflow-2026-2651","CLSA-2026-1783386117","CLSA-2026-1787146516","CLSA-2026-1788334607","EUVD-2026-31642","GHSA-8c7q-86fq-vvmh","PYSEC-2026-2220"],"status":"published","title":"Missing Authorization Validation in mlflow/mlflow","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","severity":{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00345,"percentile":0.28415,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1220","CWE-862"],"published":"2026-05-25T06:00:34Z","modified":"2026-10-30T02:15:04Z","fixes":[{"ecosystem":"PyPI","package":"mlflow","fixed_in":["3.10.0","3.11.0rc0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mlflow","fixed_in":["3.11.1"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"mlflow","fixed_in":["2.22.4.post7+tuxcare","2.9.1.post8+tuxcare"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mlflow","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.11.1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.4"},{"fixed":"2.22.4.post7+tuxcare"}]}],"versions":["2.22.4","2.22.4.post1+tuxcare","2.22.4.post2+tuxcare","2.22.4.post3+tuxcare","2.22.4.post4+tuxcare","2.22.4.post5+tuxcare","2.22.4.post6+tuxcare"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1.post8+tuxcare"}]}],"versions":["2.9.1","2.9.1.post1+tuxcare","2.9.1.post2+tuxcare","2.9.1.post3+tuxcare","2.9.1.post4+tuxcare","2.9.1.post5+tuxcare","2.9.1.post6+tuxcare","2.9.1.post7+tuxcare"]},{"source":"osv","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.2.1","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.8.0","0.8.1","0.8.2","0.9.0","0.9.0.1","0.9.1","1.0.0","1.1.0","1.1.1.dev0","1.10.0","1.11.0","1.12.0","1.12.1","1.13","1.13.1","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.20.1","1.20.2","1.21.0","1.22.0","1.23.0","1.23.1","1.24.0","1.25.0","1.25.1","1.26.0","1.26.1","1.27.0","1.28.0","1.29.0","1.3.0","1.30.0","1.30.1","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0","1.9.1","2.0.0","2.0.0rc0","2.0.1","2.1.0","2.1.1","2.10.0","2.10.1","2.10.2","2.11.0","2.11.1","2.11.2","2.11.3","2.11.4","2.11.5","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.0rc0","2.14.1","2.14.2","2.14.2.dev0","2.14.3","2.15.0","2.15.0rc0","2.15.1","2.16.0","2.16.1","2.16.2","2.17.0","2.17.0rc0","2.17.1","2.17.2","2.18.0","2.18.0rc0","2.19.0","2.19.0rc0","2.2.0","2.2.1","2.2.2","2.20.0","2.20.0rc0","2.20.1","2.20.2","2.20.3","2.20.4","2.21.0","2.21.0rc0","2.21.1","2.21.2","2.21.3","2.22.0","2.22.0rc0","2.22.1","2.22.2","2.22.3","2.22.4","2.22.5","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.4.2","2.5.0","2.6.0","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2","3.0.0","3.0.0rc0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.1","3.1.0","3.1.0rc0","3.1.1","3.1.2","3.1.3","3.1.4","3.10.0rc0","3.2.0","3.2.0rc0","3.3.0","3.3.0rc0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"]},{"source":"osv","ecosystem":"PyPI","package":"mlflow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.11.0rc0"}]}],"versions":["0.0.1","0.1.0","0.2.0","0.2.1","0.3.0","0.4.0","0.4.1","0.4.2","0.5.0","0.5.1","0.5.2","0.6.0","0.7.0","0.8.0","0.8.1","0.8.2","0.9.0","0.9.0.1","0.9.1","1.0.0","1.1.0","1.1.1.dev0","1.10.0","1.11.0","1.12.0","1.12.1","1.13","1.13.1","1.14.0","1.14.1","1.15.0","1.16.0","1.17.0","1.18.0","1.19.0","1.2.0","1.20.0","1.20.1","1.20.2","1.21.0","1.22.0","1.23.0","1.23.1","1.24.0","1.25.0","1.25.1","1.26.0","1.26.1","1.27.0","1.28.0","1.29.0","1.3.0","1.30.0","1.30.1","1.4.0","1.5.0","1.6.0","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0","1.9.1","2.0.0","2.0.0rc0","2.0.1","2.1.0","2.1.1","2.10.0","2.10.1","2.10.2","2.11.0","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.1","2.12.2","2.13.0","2.13.1","2.13.2","2.14.0","2.14.0rc0","2.14.1","2.14.2","2.14.2.dev0","2.14.3","2.15.0","2.15.0rc0","2.15.1","2.16.0","2.16.1","2.16.2","2.17.0","2.17.0rc0","2.17.1","2.17.2","2.18.0","2.18.0rc0","2.19.0","2.19.0rc0","2.2.0","2.2.1","2.2.2","2.20.0","2.20.0rc0","2.20.1","2.20.2","2.20.3","2.20.4","2.21.0","2.21.0rc0","2.21.1","2.21.2","2.21.3","2.22.0","2.22.0rc0","2.22.1","2.22.2","2.22.3","2.22.4","2.22.5","2.3.0","2.3.1","2.3.2","2.4.0","2.4.1","2.4.2","2.5.0","2.6.0","2.7.0","2.7.1","2.8.0","2.8.1","2.9.0","2.9.1","2.9.2","3.0.0","3.0.0rc0","3.0.0rc1","3.0.0rc2","3.0.0rc3","3.0.1","3.1.0","3.1.0rc0","3.1.1","3.1.2","3.1.3","3.1.4","3.10.0","3.10.0rc0","3.10.1","3.2.0","3.2.0rc0","3.3.0","3.3.0rc0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"]}],"products":[{"vendor":"lfprojects","product":"mlflow"},{"vendor":"mlflow","product":"mlflow/mlflow"},{"vendor":"red hat","product":"red hat openshift ai (rhoai)"}],"references":[{"url":"https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dc","tags":["exploit","Exploit","Third Party Advisory","advisory","web","evidence"]},{"url":"https://github.com/mlflow/mlflow/commit/d7290811d8f3c95366d80109424edc1fb1ad966f","tags":["Patch","fix","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-2651","tags":["vdb-entry","x_refsource_REDHAT","web","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2481117","tags":["issue-tracking","x_refsource_REDHAT","web","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2651.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2651","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-8c7q-86fq-vvmh","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-2220.yaml","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2651.json","tags":["advisory"]},{"url":"https://github.com/mlflow/mlflow","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-2651","title":"Missing Authorization Validation in mlflow/mlflow","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-05-25T06:00:34.002Z","modified":"2026-07-15T02:49:04.921Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-862","CWE-1220"],"updated_at":"2026-11-02T13:48:35.749498Z"}],"euvd":[{"id":"EUVD-2026-31642","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-05-25T06:00:34Z","modified":"2026-07-15T02:49:04Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:19:53.678292Z"}],"ghsa":[{"id":"GHSA-8c7q-86fq-vvmh","title":"MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-05-26T13:30:39Z","modified":"2026-10-06T18:43:57Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-862","CWE-1220"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-2651","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-05-25T07:16:15.1Z","modified":"2026-07-21T19:10:00.107Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-862","CWE-1220"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"CVE-2026-2651","title":"Missing Authorization Validation in mlflow/mlflow","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-05-25T06:00:34.002Z","modified":"2026-10-28T02:30:45.170089064Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:44:59.80315Z"},{"id":"GHSA-8c7q-86fq-vvmh","title":"MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-05-26T13:30:39Z","modified":"2026-10-06T19:00:43.189915747Z","cvss":[{"version":"3.0","score":9,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-1220","CWE-862"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"PYSEC-2026-2220","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-05-25T07:16:15.1Z","modified":"2026-07-13T16:45:09.276740322Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"BIT-mlflow-2026-2651","title":"Missing Authorization Validation in mlflow/mlflow","description":"A vulnerability in MLflow versions \u003c=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.","status":"published","published":"2026-06-05T08:52:14.527Z","modified":"2026-09-08T08:48:13.831424177Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"CLSA-2026-1783386117","title":"TuxCare security update for mlflow (1 CVE)","description":"TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.22.4.post5+tuxcare.","status":"withdrawn","published":"2026-08-04T14:52:42Z","modified":"2026-10-26T13:21:31Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1787146516","title":"TuxCare security update for mlflow (1 CVE)","description":"TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.22.4.post7+tuxcare.","status":"published","published":"2026-08-19T13:35:16Z","modified":"2026-10-30T02:15:04.457349766Z","updated_at":"2026-11-02T15:43:47.20725Z"},{"id":"CLSA-2026-1788334607","title":"TuxCare security update for mlflow (1 CVE)","description":"TuxCare rebuilt mlflow to address 1 CVE. Fixed in 2.9.1.post8+tuxcare.","status":"published","published":"2026-09-02T07:36:47Z","modified":"2026-10-15T09:48:05.766319264Z","updated_at":"2026-11-02T15:43:47.591214Z"}]}}