This vulnerability in MLflow affects versions up to 3.10.1.dev0 and involves missing authorization checks on multipart upload endpoints under the --serve-artifacts mode. Specifically, the /mlflow-artifacts/mpu/* endpoints lack proper resource-level permission enforcement, allowing unauthorized users with limited privileges to overwrite artifacts owned by others. Such unauthorized cross-user writes can result in supply chain attacks by poisoning models and may lead to arbitrary code execution upon loading the compromised models. The vulnerability is tracked as CWE-862 (Missing Authorization) and has a CVSS 3.0 base score of 9.0, indicating critical severity. The fix is included starting from MLflow version 3.10.0.

Exploitation of this vulnerability allows attackers to overwrite artifacts of other users, which can lead to model supply chain poisoning and potentially arbitrary code execution when the compromised models are loaded. This impacts confidentiality, integrity, and availability of the MLflow artifact storage and model deployment processes. The CVSS score of 9.0 reflects high impact on confidentiality, integrity, and availability.

Upgrade MLflow to version 3.10.0 or later, where this vulnerability is resolved. Since no official patch link or vendor advisory is provided, users should verify the upgrade path from the MLflow project releases. Until upgraded, restrict access to the --serve-artifacts mode and carefully control user privileges to limit exposure. Patch status is not explicitly confirmed beyond the statement that the issue is resolved in version 3.10.0; check the official MLflow release notes for confirmation.