Is CVE-2026-69148 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-69148 being exploited in the wild.

How severe is CVE-2026-69148?

High severity, with a CVSS score of 7.1, published 17 August 2026.

Which products and versions are affected?

mlflow (npm) SEMVER:introduced=0,fixed=3.15.0.

Is there a fix for CVE-2026-69148?

Yes. mlflow (npm): upgrade to 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-69148 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-69148?

Check whether you run mlflow (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-69148: MLflow CreateModelVersion authorization bypass via source validation

CVE-2026-69148 · Severity: high · CVSS 7.1 · Published 2026-08-17

MLflow is an open-source platform for managing machine learning workflows, including model versioning and artifact storage. An authenticated user can create a model version that references another user's private run and artifact directory, then read those artifacts through the model version interface—bypassing permission controls that normally prevent such access. This allows attackers to steal model weights, training data, and evaluation reports from colleagues' private experiments.

Vendors: npm.

Quick answers

Is CVE-2026-69148 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-69148 being exploited in the wild.
How severe is CVE-2026-69148?: High severity, with a CVSS score of 7.1, published 17 August 2026.
Which products and versions are affected?: mlflow (npm) SEMVER:introduced=0,fixed=3.15.0.
Is there a fix for CVE-2026-69148?: Yes. mlflow (npm): upgrade to 3.15.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69148 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-69148?: Check whether you run mlflow (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mlflow (npm): upgrade to 3.15.0 or later
```
npm install mlflow@3.15.0
```

Technical details

The vulnerability is a missing authorization check (CWE-862) in the POST /api/2.0/mlflow/model-versions/create endpoint. The _validate_source_run() function in mlflow/server/handlers.py validates that a source path is within a run's artifact directory (path containment) but does not verify that the caller has READ permission on the target run. After successful validation, the model version stores the source path and run_id pointing to the victim's artifacts. An authenticated attacker with UPDATE/MANAGE permission on any registered model can then use GET /model-versions/get-artifact to retrieve files from the victim's artifact directory, bypassing the experiment-level permission gate that blocks direct access via GET /get-artifact. The attack requires authentication and model creation privilege, but those are often granted by default. Patches were released in MLflow 3.15.0 to add authorization checks in the source validation functions.

Affected products

MLflow MLflow < 3.15.0

Identifiers

CVE-2026-69148
GHSA-gqch-g4w5-7qcw

Timeline

2026-08-17: disclosed
2026-08-17: patched: Fixed in MLflow 3.15.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.