Junglewise Threat Intelligence

CVE-2026-2651: MLflow missing authorization in multipart upload endpoints

CVE-2026-2651 · Severity: critical · CVSS 9 · Published 2026-05-25

Technologies: mlflow (PyPI). Vendors: MLflow, PyPI, Red Hat.

Executive brief

MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including the storage of models and data. A security flaw allows users with low-level access to bypass permission checks and overwrite files (artifacts) belonging to other users. This could allow an attacker to replace legitimate AI models with malicious ones, potentially leading to the theft of sensitive data or full control over systems that run the compromised models.

Technical details

A missing authorization vulnerability exists in MLflow's multipart upload (MPU) implementation when running in '--serve-artifacts' mode. The authorization logic fails to enforce resource-level permission checks for endpoints under '/mlflow-artifacts/mpu/*', allowing an authenticated attacker with low privileges to perform cross-user writes. By overwriting artifacts, an attacker can achieve model supply chain poisoning. If a victim subsequently loads a compromised model, it can result in arbitrary code execution on the victim's system. The issue is addressed in version 3.11.0rc1 (and reportedly 3.10.0 in some documentation).

Affected products

  • mlflow mlflow <= 3.10.1.dev0
  • Red Hat Red Hat OpenShift AI (RHOAI) unspecified

Timeline

  • 2026-05-25: disclosed: Initial disclosure by huntr.dev
  • 2026-05-26: advisory: GitHub Advisory published
  • 2026-06-30: patched: Advisory updated with patch information

References

Related threats