CVE-2026-2651: MLflow missing authorization in multipart upload endpoints

CVE-2026-2651 · Severity: critical · CVSS 9 · Published 2026-05-25

MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including the storage of models and data. A security flaw allows users with low-level access to bypass permission checks and overwrite files (artifacts) belonging to other users. This could allow an attacker to replace legitimate AI models with malicious ones, potentially leading to the theft of sensitive data or full control over systems that run the compromised models.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-2651 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-2651 being exploited in the wild.
How severe is CVE-2026-2651?
Critical severity, with a CVSS score of 9, published 25 May 2026.
Which products and versions are affected?
mlflow (PyPI) < 3.11.0rc0, ECOSYSTEM:introduced=0,fixed=3.11.0rc0.
Is there a fix for CVE-2026-2651?
Yes. mlflow (PyPI): upgrade to 3.11.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2651 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-2651?
Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.11.0rc0 or later
    pip install "mlflow>=3.11.0rc0"

Technical details

A missing authorization vulnerability exists in MLflow's multipart upload (MPU) implementation when running in '--serve-artifacts' mode. The authorization logic fails to enforce resource-level permission checks for endpoints under '/mlflow-artifacts/mpu/*', allowing an authenticated attacker with low privileges to perform cross-user writes. By overwriting artifacts, an attacker can achieve model supply chain poisoning. If a victim subsequently loads a compromised model, it can result in arbitrary code execution on the victim's system. The issue is addressed in version 3.11.0rc1 (and reportedly 3.10.0 in some documentation).

Affected products

  • mlflow mlflow <= 3.10.1.dev0
  • Red Hat Red Hat OpenShift AI (RHOAI) unspecified

Identifiers

  • CVE-2026-2651
  • GHSA-8c7q-86fq-vvmh
  • PYSEC-2026-2220

Timeline

  • 2026-05-25: disclosed: Initial disclosure by huntr.dev
  • 2026-05-26: advisory: GitHub Advisory published
  • 2026-06-30: patched: Advisory updated with patch information

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.