CVE-2026-69148: 
JavaScript vulnerability analysis and mitigation

CVE-2026-69148 is a missing authorization vulnerability in MLflow, an open source AI/ML engineering platform, that allows authenticated users to read arbitrary files from other users' artifact directories by bypassing experiment-level READ permission controls. The flaw affects all MLflow versions prior to 3.15.0 and was first published to the GitHub Advisory Database on August 17, 2026 (originally reported August 4, 2026). It carries a CVSS v3.1 base score of 7.1 (High) (Github Advisory).

The root cause is a missing authorization check (CWE-862) in the _validate_source_run() and _validate_source_model() functions within mlflow/server/handlers.py. These functions verify only that the model version source path is contained within the artifact directory of the specified run_id or model_id — a path traversal guard — but never verify that the calling user has READ permission on that run or model. Because downstream artifact reads via GET /model-versions/get-artifact are gated on the model version's registered model (not the source experiment), an attacker who creates a model version anchored to a victim's artifact directory can subsequently read those artifacts through their own registered model, completely bypassing the experiment-level permission gate on GET /get-artifact (Github Advisory, MLflow PR #24293).

Successful exploitation allows an authenticated MLflow user with UPDATE or MANAGE permission on any registered model to read arbitrary files — including model weights, training data samples, and evaluation reports — from any other user's run artifact directory without holding READ permission on the victim's experiment. The confidentiality impact is high, as sensitive ML artifacts stored across experiment boundaries are exposed. Integrity impact is low (the attacker can anchor a model version to another user's artifacts), and there is no availability impact. The attack is most severe in deployments configured with default_permission=NO_PERMISSIONS, where the bypass completely circumvents access controls (Github Advisory).

No public proof-of-concept exploit code has been released and no active in-the-wild exploitation has been observed as of the advisory publication date (Feedly). The vulnerability requires only low privileges (the ability to create a registered model, which is granted by default when default_permission=READ) and no user interaction, making it straightforward to exploit for any authenticated MLflow user. The EPSS score is 0.0 and the vulnerability is not listed in the CISA KEV catalog (Github Advisory). A detailed proof-of-concept scenario is included in the security advisory itself, which may lower the bar for exploitation.

1. Reconnaissance: Identify a target MLflow instance running with --app-name basic-auth and a version prior to 3.15.0. Confirm the deployment uses default_permission=NO_PERMISSIONS or that the target experiment has restricted access.
2. Identify victim's run: Obtain or enumerate a victim user's run_id (e.g., ALICE_RUN_ID) and the corresponding artifact directory path (e.g., /mlruns/2/ALICE_RUN_ID/artifacts). Direct access to the victim's artifacts via GET /get-artifact?run_id=ALICE_RUN_ID&path=secret_weights.txt returns HTTP 403.
3. Create a model version anchored to the victim's artifacts: As the attacker (Bob), send a POST request to create a model version on an attacker-controlled registered model, referencing the victim's run_id and artifact directory as the source:

POST /api/2.0/mlflow/model-versions/create HTTP/1.1
Authorization: Basic <bob_credentials>
Content-Type: application/json
{"name":"bob-model","source":"/mlruns/2/ALICE_RUN_ID/artifacts","run_id":"ALICE_RUN_ID"}

The server validates only path containment, not READ permission on the run, and returns HTTP 200. 4. Read victim's private files via model version artifact handler: Use the newly created model version to access the victim's files through the attacker's registered model:

GET /model-versions/get-artifact?name=bob-model&version=1&path=secret_weights.txt HTTP/1.1
Authorization: Basic <bob_credentials>

The server returns HTTP 200 with the file contents (e.g., ALICE_SECRET_MODEL_WEIGHTS=0.42), bypassing the experiment-level permission gate (Github Advisory).

• Network/API Logs: Unexpected POST /api/2.0/mlflow/model-versions/create requests where the run_id or source path in the request body belongs to an experiment not owned by or shared with the requesting user.
• Network/API Logs: GET /model-versions/get-artifact requests returning HTTP 200 for artifact paths that correspond to another user's experiment or run directory, especially when a direct GET /get-artifact for the same run_id would return 403.
• MLflow Audit Logs: Model version creation events where the source field references an artifact URI from a different user's experiment (cross-user run_id in CreateModelVersion).
• MLflow Audit Logs: A pattern of model version creation immediately followed by get-artifact reads on the same model version, particularly for newly created registered models with no prior history.
• Application Logs: Absence of authorization errors (403) on get-artifact calls for artifact paths that should be restricted, indicating the model-version artifact handler path is being used as a bypass (Github Advisory).

Upgrade MLflow to version 3.15.0 or later, which introduces a new validate_can_create_model_version() function in the auth layer that requires the caller to have READ permission on the source run_id and/or model_id before allowing model version creation (MLflow v3.15.0 Release, MLflow PR #24293). The fix is implemented in commit 4bb7474 and replaces the previous _validate_can_update_registered_model_or_prompt handler for CreateModelVersion with the new composite validator (MLflow Commit). No configuration-based workaround is available for unpatched versions; upgrading is the only remediation. Organizations running MLflow with --app-name basic-auth and restricted experiment permissions should treat this upgrade as critical.

The vulnerability was reported by security researcher geo-chen and published by MLflow maintainer PattaraS (Github Advisory). The fix was merged on July 6, 2026, and included in the MLflow 3.15.0 release. No significant broader media coverage or notable public researcher commentary beyond the advisory and pull request discussion has been identified.