Executive brief
MLflow is an open-source platform for managing machine learning workflows, including model versioning and artifact storage. An authenticated user can create a model version that references another user's private run and artifact directory, then read those artifacts through the model version interface—bypassing permission controls that normally prevent such access. This allows attackers to steal model weights, training data, and evaluation reports from colleagues' private experiments.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the POST /api/2.0/mlflow/model-versions/create endpoint. The _validate_source_run() function in mlflow/server/handlers.py validates that a source path is within a run's artifact directory (path containment) but does not verify that the caller has READ permission on the target run. After successful validation, the model version stores the source path and run_id pointing to the victim's artifacts. An authenticated attacker with UPDATE/MANAGE permission on any registered model can then use GET /model-versions/get-artifact to retrieve files from the victim's artifact directory, bypassing the experiment-level permission gate that blocks direct access via GET /get-artifact. The attack requires authentication and model creation privilege, but those are often granted by default. Patches were released in MLflow 3.15.0 to add authorization checks in the source validation functions.
Affected products
- MLflow MLflow < 3.15.0
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Fixed in MLflow 3.15.0