Executive brief
MLflow is an open-source platform for managing machine learning workflows and model tracking. When deployed with the built-in basic authentication plugin, the LogInputs API endpoint fails to enforce access controls, allowing any authenticated user to inject fraudulent dataset records into other users' model runs. This corrupts audit trails and dataset lineage metadata that organizations rely on for regulatory compliance and model reproducibility verification.
Technical details
The LogInputs endpoint (POST /api/2.0/mlflow/runs/log-inputs) in MLflow's basic-auth handler lacks the required authorization validator, causing it to bypass the per-run UPDATE permission check that protects other write endpoints like log-metric and log-param. The root cause is the absence of LogInputs from the BEFORE_REQUEST_HANDLERS dictionary in mlflow/server/auth/__init__.py, which maps protobuf request classes to authorization validators. When a validator is absent, the before-request hook treats the missing entry as falsy and skips the authorization check, allowing any authenticated request to proceed. An attacker with valid credentials can craft a POST request to inject arbitrary dataset records (name, digest, profile) directly into any target run's lineage table without ownership validation. The handler writes DatasetInput records to the database immediately with no secondary access control. Fixed in version 3.16.0, which adds validate_can_update_run to LogInputs and implements fail-closed behavior in the basic-auth dispatcher.
Affected products
- MLflow MLflow < 3.16.0
Timeline
- 2026-08-17: disclosed: Public disclosure via GitHub Security Advisory GHSA-3p64-6gvh-82v5
- 2026-08-04: patched: Fix merged to master branch (PR #24291, commit 5c34aec) before public disclosure
- 2026-08-17: advisory: GHSA-3p64-6gvh-82v5 published with CVSS 6.5 (Medium)