9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2651

CVE-2026-2651: Missing Authorization Validation in mlflow/mlflow

A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/* endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2651

CVE-2026-2651:

9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
mlflow	pip	< 3.11.0rc0	3.11.0rc1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability in MLflow allows unauthorized access to multipart upload (MPU) endpoints due to a flaw in the authorization logic. The analysis of the provided patch in commit d7290811d8f3c95366d80109424edc1fb1ad966f points to two specific functions whose incomplete implementation is the root cause of the issue.

mlflow.server.auth._is_proxy_artifact_path: This function is intended to check if a request path corresponds to an artifact operation that requires an authorization check. The vulnerable version of this function did not recognize the paths for MPU endpoints (/mlflow-artifacts/mpu/*). Consequently, any requests to these endpoints were not flagged for authorization, creating a security hole.
mlflow.server.auth._get_proxy_artifact_validator: This function is responsible for selecting the appropriate authorization validator based on the HTTP method of the request. The vulnerable version did not have a mapping for the POST method, which is the method used by the MPU endpoints. This omission meant that even if the path was identified as an artifact path, no authorization would be performed for POST requests.

An attacker could exploit this vulnerability by sending a POST request to an MPU endpoint for an experiment they are not authorized to access. The flawed logic in _is_proxy_artifact_path and _get_proxy_artifact_validator would cause the authorization check to be skipped, allowing the attacker to overwrite artifacts. This could lead to serious security implications such as model supply chain poisoning or arbitrary code execution when a compromised model is loaded and used.

The patch rectifies these issues by updating _is_proxy_artifact_path to include the MPU paths and by adding a POST method handler to _get_proxy_artifact_validator. These changes ensure that MPU operations are subjected to the same authorization checks as other artifact-related operations.

Vulnerable functions

mlflow.server.auth._is_proxy_artifact_path

mlflow/server/auth/__init__.py

This function is responsible for identifying if a request path is for an artifact, which would then require authorization. The vulnerable version of this function did not include the multipart upload (MPU) paths (`/mlflow-artifacts/mpu/*`). This omission meant that requests to these endpoints were not subjected to any authorization checks, allowing unauthorized users to perform artifact operations.

mlflow.server.auth._get_proxy_artifact_validator

mlflow/server/auth/__init__.py

This function maps HTTP methods to their corresponding authorization validation functions for artifact operations. The vulnerable version was missing an entry for the `POST` method, which is used by the multipart upload (MPU) endpoints. This meant that even if the MPU path was recognized, no authorization validator would be found for `POST` requests, effectively bypassing security checks for MPU operations.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.