CVE-2026-10803: 
NixOS vulnerability analysis and mitigation

CVE-2026-10803 is a weak hash vulnerability in MLflow's dataset digest computation component that allows a local low-privileged attacker to craft colliding datasets, undermining data integrity checks. It affects the mlflow.data.digest_utils function in mlflow/data/digest_utils.py across all MLflow versions up to and including 3.10.0. The vulnerability was reported on April 7, 2026 via GitHub issue #22419 and publicly disclosed on June 4, 2026. It carries a CVSS v3.1 base score of 3.6 (Low) and a CVSS v4.0 score of 1.1 (Low) (Github Advisory, MLflow Issue).

The vulnerability stems from three compounding design flaws in mlflow/data/digest_utils.py, classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-328 (Use of Weak Hash). First, the digest uses deterministic head-only sampling (df.head(10000)), meaning an attacker who controls rows beyond index 9,999 can modify them arbitrarily without changing the digest. Second, only string and numeric columns are included in the hash; datetime, boolean, category, and timedelta columns are silently excluded, enabling zero-effort collisions by modifying those column types. Third, the digest is truncated to only 8 hex characters of MD5 output (32 bits), which yields a ~50% birthday-attack collision probability at just 65,536 datasets. Exploitation requires local access and low privileges, and the attack complexity is rated High (MLflow Issue, MLflow PR).

Successful exploitation allows a local attacker to craft datasets that produce identical digests to legitimate datasets despite containing different data, effectively bypassing MLflow's dataset integrity verification. In multi-tenant environments (e.g., Databricks, SageMaker), this could enable data poisoning attacks where adversarial rows beyond the first 10,000 are injected into a "verified" training dataset, potentially producing backdoored ML models. Additionally, compliance use cases requiring cryptographic proof of data lineage (GDPR, HIPAA) are undermined, and experiment reproducibility is compromised when excluded column types (e.g., timestamps) differ between datasets that share the same digest. There is no confidentiality impact; integrity and availability impacts are rated Low (MLflow Issue, Github Advisory).

A proof-of-concept (PoC) consisting of self-contained, runnable Python scripts demonstrating hash collisions via compute_pandas_digest() is publicly available in the MLflow GitHub issue tracker (MLflow Issue). The EPSS score is approximately 0.006% (0th percentile), indicating very low probability of near-term exploitation in the wild. CISA has assessed the vulnerability with an SSVC rating of exploitation: PoC, automatable: No, technical impact: Partial, but it has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution or in-the-wild exploitation has been observed (Github Advisory).

1. Reconnaissance: Identify a target MLflow instance (version ≤ 3.10.0) where datasets are submitted and digest-based integrity checks are used, such as a shared multi-tenant deployment on Databricks or SageMaker.
2. Understand the digest algorithm: Review mlflow/data/digest_utils.py to confirm that only the first 10,000 rows and only string/numeric columns are hashed using MD5 truncated to 8 hex characters.
3. Craft a colliding dataset (row-based attack): Create a malicious DataFrame where rows 0–9,999 are identical to a legitimate dataset, but rows 10,000+ contain adversarial or poisoned data. Call compute_pandas_digest() on both to confirm the digests match:

import pandas as pd
from mlflow.data.digest_utils import compute_pandas_digest
n = 15000
df_legit = pd.DataFrame({"a": list(range(n))})
df_malicious = pd.DataFrame({"a": list(range(10000)) + [999999] * 5000})
print(compute_pandas_digest(df_legit) == compute_pandas_digest(df_malicious))  # True

4. Craft a colliding dataset (column-type attack): Alternatively, create a dataset with identical numeric columns but different datetime columns, which are silently excluded from the digest:

df1 = pd.DataFrame({"id": [1,2,3], "timestamp": pd.to_datetime(["2024-01-01","2024-01-02","2024-01-03"])})
df2 = pd.DataFrame({"id": [1,2,3], "timestamp": pd.to_datetime(["2099-12-31","2099-12-30","2099-12-29"])})
print(compute_pandas_digest(df1) == compute_pandas_digest(df2))  # True

5. Submit the malicious dataset: Log the crafted dataset to the shared MLflow tracking server under the same digest as the legitimate dataset, bypassing integrity verification.
6. Achieve objective: The poisoned dataset passes digest checks, potentially being used to train models with backdoored behavior or to cause compliance audit failures (MLflow Issue).

• Logs: MLflow tracking logs showing dataset digests that match known-good datasets but were submitted by unexpected users or at unexpected times; repeated dataset registrations with the same 8-character digest from different sources.
• File System: Presence of datasets in the MLflow artifact store where rows beyond index 9,999 differ significantly from the declared dataset description or schema, or where datetime/boolean columns contain anomalous values inconsistent with the rest of the data.
• Process/Behavioral: Execution of Python scripts locally that import mlflow.data.digest_utils and call compute_pandas_digest() in rapid succession, potentially indicating collision testing; unusual dataset submissions to shared MLflow instances from low-privileged local accounts (MLflow Issue).

The MLflow project was notified via pull request #22420, which proposes replacing head-only sampling with head+tail sampling (5,000 rows each), including all column types in the hash, upgrading from MD5[:8] to SHA-256[:32] (128-bit output), and adding dtype information to the hash input. As of the disclosure date, the fix had not been merged by maintainers, and no official patched release has been confirmed beyond the PR targeting v3.11.0. Until an official patch is released, organizations should restrict local access to MLflow systems, avoid relying solely on dataset digests for compliance or integrity verification in multi-tenant environments, and implement supplementary integrity checks (e.g., full-file checksums using SHA-256) outside of MLflow (MLflow PR, Github Advisory).

The vulnerability was reported by researcher 3em0 on April 7, 2026, who also submitted a companion pull request (#22420) with a complete fix. The MLflow maintainer @WeichenXu123 had previously commented on a related issue (#22275) that the digest algorithm was intended to be fast and handle unintentional collisions only, which the reporter directly addressed by demonstrating that the threat model includes intentional collisions in multi-tenant environments. The PR was automatically closed by GitHub Actions because the related issue lacked the ready label from a maintainer, indicating the project had not yet formally triaged the report at time of disclosure (MLflow Issue, MLflow PR).