# CVE-2026-2651: MLflow missing authorization in multipart upload endpoints

Source: https://junglewise.ai/threats/cve-2026-2651-mlflow-missing-authorization-in-multipart-upload-endpoints  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-25. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2651 · Severity: critical · CVSS 9 · Published 2026-05-25

MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including the storage of models and data. A security flaw allows users with low-level access to bypass permission checks and overwrite files (artifacts) belonging to other users. This could allow an attacker to replace legitimate AI models with malicious ones, potentially leading to the theft of sensitive data or full control over systems that run the compromised models.

Technologies: [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-2651 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2651 being exploited in the wild.

**How severe is CVE-2026-2651?** Critical severity, with a CVSS score of 9, published 25 May 2026.

**Which products and versions are affected?** mlflow (PyPI) < 3.11.0rc0, ECOSYSTEM:introduced=0,fixed=3.11.0rc0.

**Is there a fix for CVE-2026-2651?** Yes. mlflow (PyPI): upgrade to 3.11.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2651 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-2651?** Check whether you run mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mlflow (PyPI): upgrade to 3.11.0rc0 or later

  ```sh
  pip install "mlflow>=3.11.0rc0"
  ```


## Technical details

A missing authorization vulnerability exists in MLflow's multipart upload (MPU) implementation when running in '--serve-artifacts' mode. The authorization logic fails to enforce resource-level permission checks for endpoints under '/mlflow-artifacts/mpu/*', allowing an authenticated attacker with low privileges to perform cross-user writes. By overwriting artifacts, an attacker can achieve model supply chain poisoning. If a victim subsequently loads a compromised model, it can result in arbitrary code execution on the victim's system. The issue is addressed in version 3.11.0rc1 (and reportedly 3.10.0 in some documentation).

## Affected products

- mlflow mlflow <= 3.10.1.dev0
- Red Hat Red Hat OpenShift AI (RHOAI) unspecified

## Identifiers

- CVE-2026-2651
- GHSA-8c7q-86fq-vvmh
- PYSEC-2026-2220

## Timeline

- 2026-05-25: disclosed: Initial disclosure by huntr.dev
- 2026-05-26: advisory: GitHub Advisory published
- 2026-06-30: patched: Advisory updated with patch information

## References

- [https://github.com/mlflow/mlflow/commit/d7290811d8f3c95366d80109424edc1fb1ad966f](https://github.com/mlflow/mlflow/commit/d7290811d8f3c95366d80109424edc1fb1ad966f)
- [https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dc](https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dc)
- [https://access.redhat.com/security/cve/CVE-2026-2651](https://access.redhat.com/security/cve/CVE-2026-2651)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2481117](https://bugzilla.redhat.com/show_bug.cgi?id=2481117)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2651.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2651.json)

## Related threats

- [MLflow arbitrary code execution in third-party scorer deserialization](https://junglewise.ai/threats/cve-2026-116692-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow credential leak in CrewAI autolog](https://junglewise.ai/threats/cve-2026-116691-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow path traversal in prompt model version artifact access](https://junglewise.ai/threats/cve-2026-116690-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow unsafe deserialization in scorer endpoints](https://junglewise.ai/threats/cve-2026-115886-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow FileStore path traversal in trace storage](https://junglewise.ai/threats/cve-2026-53995-mlflow-3-17-1-and-earlier-contains-a-path-traversal-vulnerability)