A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.
When MLflow runs in `--serve-artifacts` mode, authorization logic does not enforce permission checks at the resource level for `/mlflow-artifacts/mpu/*` endpoints. A logged-in attacker can send requests to these endpoints and overwrite artifacts belonging to other users. Uploading a malicious model in place of a legitimate one results in any user loading that model executing code controlled by the attacker.
An attacker can overwrite models and artifacts of other users (cross-user write), leading to ML model supply chain poisoning and arbitrary code execution (RCE) on systems loading compromised models.
MLflow should be updated to version 3.10.0 or later, where the described issue has been resolved. Patch available in vendor references (commit d7290811d8f3c95366d80109424edc1fb1ad966f).
MLflow in versions <= 3.10.1.dev0 with `--serve-artifacts` mode enabled
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HLfprojects Mlflow
APPLfprojects≤ 3.10.1
Related vulnerabilities
MLflow is an open source AI engineering platform for agents, large language models, and machine learning model...
MLflow: nieprawidłowa walidacja origin umożliwia RCE przez cross-origin request
Brak uwierzytelnienia w endpointach FastAPI jobs w MLflow (Auth Bypass / RCE)
Path traversal w MLflow — nadpisanie plików i eskalacja uprawnień
Command injection w MLflow podczas inicjalizacji kontenera modelu