Description
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.
Published: 2026-08-17
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An authentication bypass in the LogInputs REST API permits any authenticated user to inject DatasetInput records into another user's run, eliminating the per‑run UPDATE permission and altering lineage metadata without authorization.

Affected Systems

MLflow (mlflow:mlflow) versions 3.13.0 through 3.14.x are impacted; the fix is delivered in release 3.15.0 and later.

Risk and Exploitability

The CVSS score of 6.5 signifies moderate severity, EPSS is unavailable and the issue is not catalogued in CISA KEV. Attackers need only a valid basic‑auth credential and can exploit the vulnerability by POSTing to /api/2.0/mlflow/runs/log-inputs with a target run_id, thereby compromising data integrity of the dataset lineage, though no remote code execution is possible.

Generated by OpenCVE AI on August 17, 2026 at 23:55 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade mlflow to version 3.15.0 or newer to apply the authorization fix for LogInputs.
  • Ensure that only users possessing per‑run UPDATE rights can access the LogInputs API, restricting basic‑auth usage to privileged accounts.
  • Enable monitoring of POST requests to /api/2.0/mlflow/runs/log-inputs and enforce least‑privilege controls on dataset input creation.

Generated by OpenCVE AI on August 17, 2026 at 23:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-3p64-6gvh-82v5 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
History

Mon, 17 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Mlflow
Mlflow mlflow
Vendors & Products Mlflow
Mlflow mlflow

Mon, 17 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Description MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.
Title MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Mlflow Mlflow
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-17T21:22:42.240Z

Reserved: 2026-08-03T15:20:30.218Z

Link: CVE-2026-69146

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-17T22:17:26.243

Modified: 2026-08-17T22:17:26.243

Link: CVE-2026-69146

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T00:00:05Z

Weaknesses