Skip to content
OpenAdvisories

Package · npm

mlflow

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-69146

    MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to c…

    MLflow MLflow mlflow npm