MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 4
https://github.com/mlflow/mlflow/commit/4bb7474771c3be808cd9e129defef9305f2869be
security-advisories@github.com
https://github.com/mlflow/mlflow/pull/24293
security-advisories@github.com
https://github.com/mlflow/mlflow/releases/tag/v3.15.0
security-advisories@github.com
https://github.com/mlflow/mlflow/security/advisories/GHSA-gqch-g4w5-7qcw
security-advisories@github.com