MLflowGHSA-46r5-x6jq-v8g6
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Medium4.3CVE-2026-33866 · Published Apr 7, 2026 · updated Sep 10, 2026
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.10.1
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.11.0rc0 | 3.11.0rc0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-862
- Also known as
- BIT-mlflow-2026-33866, CVE-2026-33866, PYSEC-2026-94
- nvd.nist.gov/vuln/detail/CVE-2026-33866
- github.com/mlflow/mlflow/pull/21708
- github.com/mlflow/mlflow/commit/005b959cacda05d1423356cfcbd9ebeda8ff96a7
- afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
- cert.pl/en/posts/2026/04/CVE-2026-33865
- github.com/mlflow/mlflow
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-94.yaml
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 7 | MLflow: cross-site scripting Medium5.4Apr 7 | Medium5.4 | 3.11.1 |
| Apr 3 | MLflow: remote code executionCritical9.1Apr 3 | Critical9.1 | No fix yet |
| Mar 31 | Mlflow: Command Injection when serving models with enable_mlserver=TrueCritical9.6Mar 31 | Critical9.6 | 3.9.0 |
| Mar 30 | MLflow Command Injection vulnerabilityCritical10.0Mar 30 | Critical10.0 | 3.8.1 |
| Mar 30 | MLFlow path traversal vulnerabilityCritical9.6Mar 30 | Critical9.6 | 3.9.0rc0 |
| Mar 27 | MLFlow allows Tracing + Assessments AccessHigh8.1Mar 27 | High8.1 | No fix yet |