Description

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-17T22:17:26.380Z",
  "pubdate": "2026-08-17T22:17:26.380Z",
  "executiveSummary": "An improper authorization and access control vulnerability exists in MLflow prior to version 3.15.0 within the model version creation functionality.\nThe vulnerability allows authenticated users to bypass permission boundaries and access sensitive data belonging to other users.\nSpecifically, the CreateModelVersion operation improperly validates source references, permitting the association of model versions with arbitrary artifact directories.\nImpact includes unauthorized data disclosure, enabling attackers to read restricted files via the GET /model-versions/get-artifact endpoint without possessing the requisite READ permissions.\nThe flaw affects the MLflow server tracking and model registry components.\nExploitation requires authentication against the MLflow platform and the ability to interact with the model registration API.\nRisk implications are significant in multi-tenant environments where isolation of model artifacts and experimental data is critical for enterprise security.",
  "technicalDetails": "The vulnerability resides in mlflow/server/handlers.py within the handling of the CreateModelVersion request.\nPrior to version 3.15.0, the backend utilizes _validate_source_run() or _validate_source_model() to evaluate parameters such as run_id or model_id.\nHowever, these validation functions exclusively verify path containment rather than performing comprehensive access control checks against the requesting user's authorization level or specific resource ownership.\nBecause path containment checks only ensure that the target path resolves within the expected storage boundaries without enforcing mandatory READ permissions on the underlying resources, a privilege bypass condition is introduced.\nThe attack flow proceeds as follows: First, an authenticated attacker with standard or restricted privileges identifies or guesses a target run_id or model_id belonging to a restricted artifact directory owned by another user or tenant.\nSecond, the attacker issues a CreateModelVersion request pointing to this unauthorized run_id or model_id.\nBecause the input validation logic only confirms basic path containment via _validate_source_run() or _validate_source_model(), the server successfully creates the model version linking to the foreign artifact path.\nThird, the attacker leverages the newly created model version to invoke the GET /model-versions/get-artifact endpoint.\nThe endpoint serves the artifact content associated with the model version, effectively bypassing the access controls that would normally prevent unauthorized users from retrieving files from another user's isolated directory.\nThe vulnerable component is the server-side request handler managing model version creation and artifact retrieval.\nAffected versions include all MLflow deployments prior to 3.15.0.\nThe vulnerability requires network exposure of the MLflow server, valid authentication credentials, and minimal privileges to interact with the API endpoints, leading directly to unauthorized post-exploitation file read capabilities."
}