CVE-2026-69148: 
JavaScript vulnerability analysis and mitigation

CVE-2026-69148 is a missing authorization vulnerability in MLflow, an open-source AI engineering platform, that allows authenticated users to read arbitrary files from other users' artifact directories by bypassing experiment-level READ permission controls. The flaw exists in the CreateModelVersion API endpoint, where source validation checks only path containment rather than caller authorization on the referenced run_id or model_id. All MLflow versions prior to 3.15.0 are affected. The vulnerability was reported by researcher geo-chen, published to the GitHub Advisory Database on August 17, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory).

The root cause is CWE-862 (Missing Authorization): the _validate_source_run() and _validate_source_model() functions in mlflow/server/handlers.py call store.get_run(run_id) to retrieve a run and verify that the source path is contained within the run's artifact directory, but perform no permission check on whether the caller is authorized to READ that run or model. Because POST /api/2.0/mlflow/model-versions/create only gates on the caller's UPDATE permission on the target registered model, an attacker can supply another user's run_id and a source path pointing into that user's artifact directory. Once the model version is created, the attacker holds MANAGE permission on it and can retrieve any file from the victim's artifact directory via GET /model-versions/get-artifact, which derives the artifact path from the stored source — completely bypassing the experiment-level READ gate on GET /get-artifact. A detailed proof-of-concept demonstrating the bypass was included in the security advisory (Github Advisory, MLflow PR #24293).

Successful exploitation allows an authenticated MLflow user with UPDATE or MANAGE permission on any registered model to read arbitrary files — including model weights, training data samples, and evaluation reports — from any other user's run artifact directory without holding READ permission on the victim's experiment. The impact is primarily a high confidentiality breach across experiment boundaries, with a low integrity impact (the attacker can anchor a model version to data they do not own). Availability is not affected. The vulnerability is most severe in multi-tenant deployments configured with default_permission=NO_PERMISSIONS, where experiment-level access controls are explicitly enforced (Github Advisory).

A detailed proof-of-concept (PoC) was included in the GitHub security advisory and was live-validated against MLflow v3.13.0, confirming the bypass works with default_permission=READ and escalates to a full bypass under default_permission=NO_PERMISSIONS. The NVD SSVC assessment classifies exploitation as "poc" with technical impact "partial" and automatable "no", indicating manual steps are required. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.217% (12th percentile), reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify a target MLflow deployment running with --app-name basic-auth and a version prior to 3.15.0. Confirm that the target experiment (owned by the victim) has restricted permissions (e.g., default_permission=NO_PERMISSIONS or no explicit READ grant for the attacker).
2. Obtain a valid account: Authenticate as a user ("Bob") who has UPDATE or MANAGE permission on at least one registered model. With default_permission=READ, any model creator automatically qualifies.
3. Identify the victim's run_id: Enumerate or guess the victim's (ALICE_RUN_ID) run identifier. The run ID may be discoverable through other API calls or shared metadata.
4. Attempt direct artifact access (blocked): Confirm the permission boundary by sending GET /get-artifact?run_id=ALICE_RUN_ID&path=secret_weights.txt with Bob's credentials — this should return HTTP 403.
5. Create a model version anchored to the victim's artifact directory: Send the following request as Bob:

POST /api/2.0/mlflow/model-versions/create
Authorization: Basic <bob_credentials>
Content-Type: application/json
{"name":"bob-model","source":"/mlruns/2/ALICE_RUN_ID/artifacts","run_id":"ALICE_RUN_ID"}

The server returns HTTP 200 and creates the model version with source pointing to Alice's artifact directory. 6. Read victim's files via model version artifact handler: Send GET /model-versions/get-artifact?name=bob-model&version=1&path=secret_weights.txt with Bob's credentials — the server returns HTTP 200 with the file contents, bypassing the experiment-level READ gate (Github Advisory).

• Network/API Logs: HTTP POST requests to /api/2.0/mlflow/model-versions/create where the run_id in the request body belongs to an experiment the requesting user does not have READ permission on; followed shortly by GET requests to /model-versions/get-artifact for the same model version name and version number.
• MLflow Audit Logs: Model version creation events where the source path and run_id reference an experiment owned by a different user than the model creator.
• Anomalous Access Patterns: A user account accessing artifact files from experiments they have no explicit READ grant on, specifically via the model-versions/get-artifact endpoint rather than the standard get-artifact endpoint.
• Model Registry: Registered model versions whose source URI points to an artifact directory belonging to a different user's experiment or run than the model owner (Github Advisory).

Upgrade MLflow to version 3.15.0 or later, which introduces a new validate_can_create_model_version() function in mlflow/server/auth/__init__.py that requires the caller to have READ permission on the source run_id and/or model_id in addition to UPDATE permission on the target registered model. The fix was merged via PR #24293 (commit 4bb7474) and is included in the v3.15.0 release. No configuration-based workaround is available for unpatched versions; as an interim measure, administrators can restrict model creation permissions or set default_permission=NO_PERMISSIONS and audit registered model versions for cross-user source references (MLflow PR #24293, MLflow v3.15.0).

The vulnerability was reported by researcher geo-chen and disclosed responsibly through GitHub's security advisory process. The fix was developed by MLflow maintainer PattaraS and reviewed by automated tools (NaiLaOpus, Copilot) as well as the mlflow-app bot, which approved the changes. The advisory was picked up by standard vulnerability tracking services including Qualys, VulnDB, OSV, and Tenable shortly after publication. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been observed (Github Advisory).