CVE-2026-69148

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0

Description Authenticated users can bypass experiment-level READ permissions to access arbitrary files from another user's artifact directory. The issue occurs because the validate source run() and validate source model() functions in mlflow/server/handlers.py only verify path containment and do not check if the caller has the necessary READ permissions for the specified run or model. An attacker can use the POST /api/2.0/mlflow/model-versions/create endpoint by providing a victim's run id or model id in the source parameter. Once the model version is created, the attacker can use the GET /model-versions/get-artifact endpoint to read sensitive files, such as model weights or training data, from the victim's directory.

Recommendations Update MLflow to version 3.15.0.