An unauthenticated remote attacker can exploit multiple vulnerabilities in the MLflow machine learning platform to bypass access controls and compromise internal infrastructure. These security flaws allow adversaries to perform unauthorized server-side requests, access restricted run data, and tamper with model artifacts without proper authorization. Successful exploitation can lead to internal network reconnaissance, sensitive data exposure, and unauthorized modification of machine learning pipelines. Organizations utilizing vulnerable versions of MLflow face high operational and confidentiality risks due to these authentication and authorization gaps. Upgrading installations to patched releases remains essential to securing artificial intelligence workflows and sensitive telemetry data.
CVE-2026-64849: An unauthenticated server-side request forgery vulnerability exists within the webhook delivery mechanism due to improper validation in the URL checking function. Attackers can bypass validation routines via unvalidated HTTP redirects or DNS rebinding techniques to force the server to send requests to arbitrary internal addresses. Exploitation enables malicious actors to scan internal network infrastructure, access restricted cloud metadata endpoints, and interact with internal services that are otherwise unreachable from external networks.[/subscribe_to_unlock_form]
An unauthenticated remote attacker can exploit multiple vulnerabilities in the MLflow machine learning platform to bypass access controls and compromise internal infrastructure. These security flaws allow adversaries to perform unauthorized server-side requests, access restricted run data, and tamper with model artifacts without proper authorization. Successful exploitation can lead to internal network reconnaissance, sensitive data exposure, and unauthorized modification of machine learning pipelines. Organizations utilizing vulnerable versions of MLflow face high operational and confidentiality risks due to these authentication and authorization gaps. Upgrading installations to patched releases remains essential to securing artificial intelligence workflows and sensitive telemetry data.
CVE-2026-64849: An unauthenticated server-side request forgery vulnerability exists within the webhook delivery mechanism due to improper validation in the URL checking function. Attackers can bypass validation routines via unvalidated HTTP redirects or DNS rebinding techniques to force the server to send requests to arbitrary internal addresses. Exploitation enables malicious actors to scan internal network infrastructure, access restricted cloud metadata endpoints, and interact with internal services that are otherwise unreachable from external networks.[emaillocker id="1283"]
CVE-2026-69146: An authorization bypass vulnerability in the basic authentication implementation affects the LogInputs endpoint of the application. The system fails to enforce per-run UPDATE permissions, allowing authenticated users with lower-level access to manipulate input parameters associated with runs they should not be permitted to modify. Attackers can leverage this vulnerability to alter experiment metadata, corrupt training inputs, and disrupt tracking integrity across shared machine learning environments.
CVE-2026-69148: An authorization check failure in the CreateModelVersion function allows users to reference run identifiers without validating READ permissions on the underlying resources. Unprivileged users can exploit this logic flaw to access and link restricted run artifacts to new model versions, effectively bypassing access restrictions. This poses a significant confidentiality risk by allowing unauthorized entities to expose proprietary model binaries, training parameters, and sensitive outputs across isolated projects.
Organizations using the MLflow platform should audit their current deployment configurations and restrict network exposure to management endpoints. Prompt application of security patches and strict enforcement of role-based access control policies are strongly recommended to prevent unauthorized exploitation.
We recommend you to update mlflow to version 3.15.0
The following reports contain further technical details:
[/emaillocker]