CVE-2026-69146

Name of the Vulnerable Software and Affected Versions MLflow versions 3.13.0 through 3.14.x

Description When deployed with the built-in basic-auth plugin, an authenticated user can inject arbitrary dataset records into another user's run. This occurs because the LogInputs proto handler is missing from the BEFORE REQUEST HANDLERS map in the mlflow/server/auth package, causing the authorization hook to be skipped. An attacker can use the 'POST /api/2.0/mlflow/runs/log-inputs' endpoint to add attacker-controlled DatasetInput records to the lineage metadata of any run id without requiring UPDATE permissions. This can lead to the corruption of dataset provenance records, which are critical for audit evidence, model reproducibility, and regulatory review.

Recommendations Update to version 3.15.0. As a temporary workaround, restrict access to the 'POST /api/2.0/mlflow/runs/log-inputs' endpoint to minimize the risk of exploitation.