Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mlflow | pip | < 3.10.0 | 3.10.0 |
Miggo AIRoot Cause AnalysisThe vulnerability allows authenticated users to enumerate all model versions, regardless of their permissions. This is due to missing authorization checks in both the REST and GraphQL APIs.
For the GraphQL API, the vulnerability lies in the GraphQLAuthorizationMiddleware.resolve function. This function is responsible for authorization of GraphQL queries. Before the patch, it did not perform any filtering on the results of the mlflowSearchModelVersions query, returning all model versions to any authenticated user. The patch fixes this by adding a post-resolution filtering step that checks the user's permissions.
For the REST API, the vulnerability is due to a missing authorization check for the SearchModelVersions endpoint. The patch fixes this by introducing a new filter function, filter_search_model_versions, and registering it to be called after the request is processed. This function filters the model versions based on the user's permissions. The original function that handles the SearchModelVersions endpoint and returns the unfiltered data is not explicitly shown in the provided patch, so it is not included in the list of vulnerable functions, but the vulnerability is in the handling of that endpoint.
