Skip to content
OpenAdvisories

Package · npm

mlflow

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.5
    CVE-2026-69146

    MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to c…

    MLflow MLflow mlflow npm
  • High 7.1
    CVE-2026-69148

    MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handler…

    MLflow MLflow mlflow npm