CVE-2026-10803 identifies a weakness in MLflow's dataset digest computation due to the use of a weak hash function in the mlflow.data.digest_utils module. This vulnerability affects all MLflow versions up to 3.10.0. Exploitation requires local access and is considered difficult with high complexity. Although an exploit has been published, the MLflow project has not yet issued a fix or official response. The CVSS 4.0 vector indicates low severity with local attack vector, high attack complexity, and limited impact on confidentiality, integrity, and availability.

The use of a weak hash function in MLflow's dataset digest computation could potentially allow an attacker with local access to manipulate or bypass integrity checks related to dataset digests. However, the low CVSS score and high attack complexity suggest limited practical impact. There is no indication of remote exploitation or privilege escalation. No known exploits are currently observed in the wild.

No official patch or remediation is currently available for this vulnerability. Users should monitor the MLflow project for updates or fixes. Given the local and complex nature of the attack, limiting local access to trusted users may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.