CVE-2026-2651: 
NixOS vulnerability analysis and mitigation

CVE-2026-2651 is a Missing Authorization vulnerability in MLflow that allows authenticated attackers to overwrite artifacts belonging to other users via unprotected multipart upload (MPU) endpoints. The flaw affects MLflow versions up to and including 3.10.1.dev0 when the --serve-artifacts mode is enabled, and is resolved in version 3.10.0. It was published on May 25, 2026, with a patch committed on June 4, 2026. The vulnerability carries a CVSS v3.0 base score of 9.0 (Critical) (Feedly, ENISA EUVD).

The root cause is CWE-862 (Missing Authorization): the authorization logic in MLflow's artifact proxy server fails to enforce resource-level permission checks for /mlflow-artifacts/mpu/* endpoints (covering create, complete, and abort actions). While standard artifact upload/download endpoints (/mlflow-artifacts/artifacts) were protected, the multipart upload paths were omitted from the _is_proxy_artifact_path() function and the _get_proxy_artifact_validator() method, meaning POST requests to these endpoints bypassed all ownership validation. The fix, committed in GitHub commit d729081, adds both REST and AJAX API MPU path prefixes to the proxy artifact path detection logic and maps POST requests to the validate_can_update_experiment_artifact_proxy validator. A proof-of-concept is available via a Huntr bounty report (Huntr PoC).

Successful exploitation allows any authenticated user to overwrite ML model artifacts belonging to other users, enabling model supply chain poisoning — a scenario where a compromised model is subsequently loaded and executed by a victim user or automated pipeline, resulting in arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability at a high level with a changed scope, meaning impact can extend beyond the directly targeted user or experiment. In multi-tenant MLflow deployments, this could facilitate lateral movement across user workspaces and compromise downstream systems that consume poisoned models (Feedly, ENISA EUVD).

1. Reconnaissance: Identify a target MLflow instance running with --serve-artifacts mode enabled and a version ≤3.10.1.dev0. Enumerate accessible experiments and their artifact paths using the MLflow REST API (e.g., GET /api/2.0/mlflow/experiments/list).
2. Obtain valid credentials: Authenticate to the MLflow server with any low-privilege user account (attacker's own credentials suffice).
3. Identify target experiment: Determine the experiment_id of a target experiment owned by another user whose artifacts the attacker wishes to overwrite.
4. Initiate multipart upload: Send a POST request to the unprotected MPU create endpoint for the target experiment, bypassing authorization checks:

   POST /api/2.0/mlflow-artifacts/mpu/create/{experiment_id}/artifacts/model
   Authorization: Basic <attacker_credentials>
   Content-Type: application/json
   {"path": "python_model.pkl", "num_parts": 1}

5. Upload malicious artifact: Use the returned upload ID to upload a crafted, malicious model file (e.g., a pickle file with embedded code execution payload) via the multipart upload parts.
6. Complete the upload: POST to /api/2.0/mlflow-artifacts/mpu/complete/{experiment_id}/artifacts/model to finalize the overwrite of the victim's artifact.
7. Trigger code execution: Wait for or socially engineer the victim user or an automated ML pipeline to load the poisoned model, triggering arbitrary code execution in their environment (Huntr PoC, GitHub Commit).

• Network: Unexpected POST requests from non-owning users to /api/2.0/mlflow-artifacts/mpu/create/, /api/2.0/mlflow-artifacts/mpu/complete/, or /api/2.0/mlflow-artifacts/mpu/abort/ endpoints targeting experiment IDs they do not own; cross-user artifact upload activity in MLflow access logs.
• Logs: MLflow server access logs showing POST requests to /mlflow-artifacts/mpu/* paths authenticated by users who are not the experiment owner; HTTP 200 responses to MPU endpoints from accounts with no explicit experiment permissions (on unpatched versions).
• File System: Unexpected modification timestamps on model artifact files (e.g., python_model.pkl, MLmodel) in the artifact store; newly written or replaced model files in experiment artifact directories not corresponding to legitimate run activity.
• Process: Unusual processes spawned by ML serving infrastructure or pipeline workers after loading a model artifact; unexpected outbound network connections from model serving processes.

Upgrade MLflow to version 3.10.0 or later, which includes the authorization fix for MPU endpoints (GitHub Commit). If immediate patching is not feasible, disable the --serve-artifacts mode to eliminate the vulnerable attack surface. Additionally, implement network-level access controls to restrict access to MLflow artifact endpoints to trusted users only, and monitor artifact stores for unauthorized modifications to model files (Feedly).

The vulnerability was discovered and reported through the Huntr AI bug bounty platform, which assigned it a high-confidence PoC classification (Huntr PoC). A Bluesky post from the cyberhub.blog account noted the vulnerability shortly after disclosure. Coverage has been limited to automated vulnerability tracking platforms (Vulners, CVEFeed, VulDB, CIRCL), with no major vendor statements or significant researcher commentary beyond the patch commit and Huntr report.