CVE-2026-2651: MLflow Auth Bypass Vulnerability

CVE-2026-2651 Overview

CVE-2026-2651 is a missing authorization vulnerability [CWE-862] in MLflow versions <=3.10.1.dev0 that affects deployments running with the --serve-artifacts mode enabled. The authorization layer fails to enforce resource-level permission checks on /mlflow-artifacts/mpu/* multipart upload (MPU) endpoints. Authenticated attackers can write to artifact paths owned by other users without authorization. The flaw enables cross-tenant artifact overwrites, model supply chain poisoning, and arbitrary code execution when poisoned models are subsequently loaded by victims. The issue is fixed in MLflow version 3.10.0.

Critical Impact

A low-privileged authenticated user can overwrite another user's machine learning artifacts, leading to model supply chain poisoning and arbitrary code execution upon model load.

Affected Products

• MLflow versions <=3.10.1.dev0 with --serve-artifacts enabled
• MLflow REST API path /api/2.0/mlflow-artifacts/mpu/*
• MLflow AJAX API path /ajax-api/2.0/mlflow-artifacts/mpu/*

Discovery Timeline

• 2026-05-25 - CVE-2026-2651 published to NVD
• 2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-2651

Vulnerability Analysis

MLflow is an open-source platform for managing the machine learning lifecycle, including experiment tracking, model registry, and artifact storage. When MLflow runs with the --serve-artifacts flag, the server proxies artifact storage requests through its HTTP API. The authorization plugin enumerates a list of path prefixes that require resource-level permission checks before granting access to write operations.

The vulnerability stems from an incomplete prefix list. The authorization function recognized /mlflow-artifacts/artifacts paths but omitted the /mlflow-artifacts/mpu/ multipart upload routes. Requests targeting MPU endpoints bypassed the per-resource permission evaluation entirely while still passing baseline authentication. An authenticated user with any valid credentials could issue multipart upload requests that wrote to artifact locations owned by unrelated experiments, runs, or registered models.

Root Cause

The root cause is missing authorization [CWE-862] in mlflow/server/auth/__init__.py. The helper that determines whether a request path requires artifact permission checks compared incoming paths only against the artifacts prefix. The MPU code path was introduced separately and was not added to the protected-prefix list, so the auth middleware did not enforce ownership checks on multipart write operations.

Attack Vector

Exploitation requires network access to the MLflow tracking server, valid low-privileged credentials, and --serve-artifacts enabled. An attacker initiates a multipart upload against the target's artifact URI via the MPU endpoint and uploads malicious payloads, including serialized model files such as pickled Python objects. When a victim later loads the registered model through mlflow.pyfunc.load_model or equivalent loaders, the embedded payload executes in the victim's runtime context.

     prefixes = [
         f"{_REST_API_PATH_PREFIX}/mlflow-artifacts/artifacts",
         f"{_AJAX_API_PATH_PREFIX}/mlflow-artifacts/artifacts",
+        f"{_REST_API_PATH_PREFIX}/mlflow-artifacts/mpu/",
+        f"{_AJAX_API_PATH_PREFIX}/mlflow-artifacts/mpu/",
     ]
     return any(path.startswith(prefix) for prefix in prefixes)

The patch adds the MPU REST and AJAX prefixes to the protected-prefix list so MPU requests are routed through the same permission evaluation logic as standard artifact writes. Source: MLflow commit d7290811.

Detection Methods for CVE-2026-2651

Indicators of Compromise

• HTTP requests to /api/2.0/mlflow-artifacts/mpu/* or /ajax-api/2.0/mlflow-artifacts/mpu/* from user accounts that do not own the targeted artifact path.
• Unexpected modifications to model registry artifacts, including changes to MLmodel, conda.yaml, or pickled .pkl files outside scheduled training runs.
• Newly written artifact files whose authoring user does not match the owning experiment or run.
• Python child processes spawned from MLflow serving containers shortly after model load operations.

Detection Strategies

• Enable MLflow access logging and alert on mpu path access where the requesting principal does not match the artifact owner.
• Compute and store cryptographic hashes of registered model artifacts, then alert on out-of-band changes between training runs.
• Correlate MLflow API audit events with downstream model load events to identify poisoned artifact loads.

Monitoring Recommendations

• Forward MLflow server logs and reverse proxy access logs to a centralized analytics platform for cross-user write detection.
• Monitor process lineage on hosts that load MLflow models for unexpected interpreter spawns, network connections, or filesystem writes.
• Track MLflow version inventory and flag any tracking servers running <=3.10.1.dev0 with --serve-artifacts enabled.

How to Mitigate CVE-2026-2651

Immediate Actions Required

• Upgrade MLflow to version 3.10.0 or later, which adds the MPU prefixes to the authorization prefix list.
• Audit artifact storage for unauthorized writes occurring before the upgrade, focusing on multipart upload activity.
• Rotate or revoke MLflow user credentials that may have been used to deliver malicious artifacts.
• Restrict network exposure of the MLflow tracking server to trusted client ranges only.

Patch Information

The fix is committed in MLflow commit d7290811, titled "Auth support for MPU endpoints (#20919)". It extends the protected-prefix list in mlflow/server/auth/__init__.py to cover both REST and AJAX MPU routes. Additional context is available in the Huntr bounty report.

Workarounds

• Disable --serve-artifacts mode and use a dedicated object storage backend with its own access controls if upgrading is not immediately feasible.
• Place a reverse proxy in front of MLflow that blocks or authenticates /mlflow-artifacts/mpu/* requests against an external authorization service.
• Restrict MLflow accounts to read-only roles where write access is not strictly required.

# Reverse proxy rule example (NGINX) to deny MPU until patched
location ~ ^/(api|ajax-api)/2\.0/mlflow-artifacts/mpu/ {
    return 403;
}