Executive brief
MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including tracking experiments and storing models. A security flaw in its tracking service allows an authenticated user to download machine learning model files (artifacts) from experiments they are not supposed to see. This could lead to the unauthorized exposure of proprietary AI models or sensitive training data.
Technical details
MLflow is vulnerable to a missing authorization check (CWE-862) in its Tracking Service. The specific AJAX endpoint `GET /ajax-api/2.0/mlflow/logged-models/<model_id>/artifacts/files` was implemented as a plain Flask route rather than a gRPC service, causing it to be excluded from the auto-generated validator dictionary used by the platform's authentication middleware. As a result, any authenticated user can directly query this endpoint to retrieve model artifacts without having the required READ permissions for the parent experiment. The vulnerability is addressed in version 3.11.0rc0 by explicitly registering the endpoint with the `validate_can_read_logged_model` validator.
Affected products
- MLflow MLflow <= 3.10.1
Timeline
- 2026-03-16: other: Fix submitted via pull request
- 2026-03-23: patched: Fix merged into master branch
- 2026-04-07: disclosed: Vulnerability disclosed by CERT.PL
- 2026-04-07: advisory: GitHub Advisory published
References
- https://github.com/mlflow/mlflow/pull/21708
- https://cert.pl/en/posts/2026/04/CVE-2026-33865
- https://github.com/mlflow/mlflow/commit/005b959cacda05d1423356cfcbd9ebeda8ff96a7
- https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-94.yaml