PT-2026-30821

CVE-2026-33866

Published

2026-04-07

Updated

2026-04-21

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.10.1

Description An authorization bypass exists in the AJAX endpoint used to download saved model artifacts. Due to missing access-control validation, a user without permissions to a specific experiment can directly query this endpoint to retrieve model artifacts they are not authorized to access.

Recommendations Update to a version newer than 3.10.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Sławomir Zakrzewski

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers