CVE-2026-2651 Missing Authorization Validation in mlflow/mlflow
Attackers can overwrite other users' artifacts in MLflow when artifact serving is enabled, potentially leading to model poisoning and code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-2651?
CVE-2026-2651 is a critical missing authorization vulnerability in Lfprojects Mlflow, published on 25 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.
Which versions are affected by CVE-2026-2651?
4 open source packages ship an affected version, including mlflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mlflow Bitnami | All versions | 3.11.1 |
mlflow PyPI | All versions | 3.10.0 |
mlflow PyPI | All versions | 3.10.0 |
mlflow PyPI | All versions | 3.11.0rc0 |
Products include Lfprojects Mlflow.
How do I fix CVE-2026-2651?
Upgrade mlflow to a fixed version for your release line: 3.11.1, 3.10.0 or 3.11.0rc0.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-2651 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-2651 exists.
Other vulnerabilities in Lfprojects Mlflow
- CVE-2026-64849 MLflow Server-Side Request Forgery
- CVE-2025-15379 Command Injection in mlflow/mlflow
- CVE-2024-0520 Remote Code Execution due to Full Controlled File Write in mlflow/mlflow
- CVE-2023-6977 Path Traversal: '\..\filename'
- CVE-2023-6709 Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow
Sources
Also known as BIT-mlflow-2026-2651, CLSA-2026-1787146516, CLSA-2026-1788334607, GHSA-8c7q-86fq-vvmh, PYSEC-2026-2220.