MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693
security-advisories@github.com
https://github.com/mlflow/mlflow/pull/24291
security-advisories@github.com
https://github.com/mlflow/mlflow/releases/tag/v3.15.0
security-advisories@github.com
https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5
security-advisories@github.com