Advisoriesby IbisMLflowGHSA-46r5-x6jq-v8g6
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
Fix: upgrade to 3.11.0rc0 or later
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access.
This issue affects MLflow version through 3.10.1
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.11.0rc0 | 3.11.0rc0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-862
- Also known as
- BIT-mlflow-2026-33866, CVE-2026-33866, PYSEC-2026-94
- nvd.nist.gov/vuln/detail/CVE-2026-33866
- github.com/mlflow/mlflow/pull/21708
- github.com/mlflow/mlflow/commit/005b959cacda05d1423356cfcbd9ebeda8ff96a7
- afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
- cert.pl/en/posts/2026/04/CVE-2026-33865
- github.com/mlflow/mlflow
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-94.yaml
More MLflow advisories
All MLflow
MLflow: cross-site scriptingCVE-2026-33865fixed in 3.11.1MLflow: remote code executionCVE-2026-0545no fix yetMlflow: Command Injection when serving models with enable_mlserver=TrueCVE-2026-0596fixed in 3.9.0MLflow Command Injection vulnerabilityCVE-2025-15379fixed in 3.8.1MLFlow path traversal vulnerabilityCVE-2025-15036fixed in 3.9.0rc0MLFlow allows Tracing + Assessments AccessCVE-2025-15381no fix yet