MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id (CVE-2026-69148)
MLflow versions prior to 3.15.0 contain a vulnerability in the CreateModelVersion functionality where source validation does not properly check READ permissions on the referenced run_id. This allows authenticated users to create a model version that references another user's artifact directory and read files without the required permissions. The issue is fixed in version 3.15.0.
AI Analysis
Technical Summary
In MLflow before version 3.15.0, the CreateModelVersion API accepts a run_id or model_id after validating only path containment via _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py. However, it does not verify that the user has READ permission on the referenced run_id. This flaw enables an authenticated user to create a model version that references another user's artifact directory and read files through the GET /model-versions/get-artifact endpoint without proper authorization. The vulnerability is resolved in MLflow 3.15.0.
Potential Impact
Authenticated users can bypass READ permission checks on referenced run_ids when creating model versions, potentially allowing unauthorized access to another user's artifact files. This could lead to information disclosure of sensitive model artifacts.
Mitigation Recommendations
Upgrade MLflow to version 3.15.0 or later, where this issue is fixed. Since a patch is available and the vulnerability is resolved in the official release, applying the official fix is the recommended remediation.
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id (CVE-2026-69148)
Description
MLflow versions prior to 3.15.0 contain a vulnerability in the CreateModelVersion functionality where source validation does not properly check READ permissions on the referenced run_id. This allows authenticated users to create a model version that references another user's artifact directory and read files without the required permissions. The issue is fixed in version 3.15.0.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In MLflow before version 3.15.0, the CreateModelVersion API accepts a run_id or model_id after validating only path containment via _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py. However, it does not verify that the user has READ permission on the referenced run_id. This flaw enables an authenticated user to create a model version that references another user's artifact directory and read files through the GET /model-versions/get-artifact endpoint without proper authorization. The vulnerability is resolved in MLflow 3.15.0.
Potential Impact
Authenticated users can bypass READ permission checks on referenced run_ids when creating model versions, potentially allowing unauthorized access to another user's artifact files. This could lead to information disclosure of sensitive model artifacts.
Mitigation Recommendations
Upgrade MLflow to version 3.15.0 or later, where this issue is fixed. Since a patch is available and the vulnerability is resolved in the official release, applying the official fix is the recommended remediation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-mlflow-2026-69148
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-69148"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- High
- Cvss Version
- null
Threat ID: 6a885f27acd9273b493f8195
Added to database: 08/21/2026, 14:22:31 UTC
Last enriched: 08/21/2026, 14:37:12 UTC
Last updated: 08/21/2026, 22:52:14 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.