Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-17T22:17:26.243Z",
  "pubdate": "2026-08-17T22:17:26.243Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the MLflow open source AI engineering platform, specifically affecting the mlflow/server/auth package. The vulnerability stems from the absence of the LogInputs handler from the BEFORE_REQUEST_HANDLERS configuration. This security oversight allows any authenticated user to exploit the POST /api/2.0/mlflow/runs/log-inputs endpoint for arbitrary run identifiers belonging to other users. The business impact involves the unauthorized injection of attacker-controlled DatasetInput records into dataset_inputs lineage metadata without possessing the requisite UPDATE permissions. Risk implications include the integrity compromise of machine learning experiment tracking, data poisoning of training provenance records, and potential evasion of access control boundaries within multi-tenant AI development environments. Exploitation requires valid authentication against the MLflow server API, after which an attacker can execute unauthorized state-modifying requests against foreign experiment runs. The vulnerability affects MLflow versions from 3.13.0 up to, but not including, 3.15.0, and has been officially resolved in version 3.15.0 by properly enforcing request handling authorization checks.",
  "technicalDetails": "The vulnerability resides in the authentication and request handling architecture of the mlflow/server/auth package within the MLflow platform. The root cause of the security flaw is the omission of the LogInputs handler from the critical BEFORE_REQUEST_HANDLERS mapping array. In MLflow's authentication framework, BEFORE_REQUEST_HANDLERS mechanisms are responsible for intercepting incoming API requests and validating whether the authenticated principal holds sufficient privileges to execute specific actions against target resources.\nBecause the LogInputs handler is missing from this enforcement array, the application fails to validate whether the requesting user possesses explicit UPDATE permissions on the target run_id prior to processing the operation. The vulnerable component is the server-side request routing and authorization validation logic governing the POST /api/2.0/mlflow/runs/log-inputs endpoint. Network exposure includes any deployment where the MLflow tracking server is accessible to authenticated API clients.\nThe step-by-step attack flow proceeds as follows: First, an authenticated attacker establishes a session or acquires valid API credentials within the target MLflow instance. Second, the attacker crafts a malicious HTTP POST request targeting the /api/2.0/mlflow/runs/log-inputs endpoint. Within the JSON payload of this request, the attacker specifies a run_id belonging to a different user or project for which they possess no administrative or update rights. Third, the attacker injects arbitrary, attacker-controlled DatasetInput records within the payload parameters. Fourth, because the BEFORE_REQUEST_HANDLERS configuration lacks the LogInputs verification, the server bypasses authorization checks and directly processes the request. Finally, the malicious dataset lineage metadata is appended to the victim's run record.\nPost-exploitation impact centers on data integrity degradation. By successfully injecting fraudulent DatasetInput records, an attacker can manipulate model provenance graphs, corrupt audit trails, falsify compliance tracking data, and potentially mislead data science pipelines relying on trustworthy lineage metadata."
}