CVE-2026-69146: MLflow Authentication Bypass Vulnerability

CVE-2026-69146 Overview

CVE-2026-69146 is a missing authorization vulnerability [CWE-862] in MLflow, an open source AI engineering platform for agents, large language models, and machine learning models. Versions from 3.13.0 up to (but not including) 3.15.0 omit LogInputs from the BEFORE_REQUEST_HANDLERS list in the mlflow/server/auth package. This gap allows any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs against another user's run_id. Attackers can inject controlled DatasetInput records into dataset_inputs lineage metadata without holding UPDATE permission on the target run. The issue is fixed in MLflow 3.15.0.

Critical Impact
Authenticated users can tamper with dataset lineage metadata of runs owned by other users, corrupting model provenance and audit trails used in machine learning pipelines.

Affected Products

MLflow versions 3.13.0 through 3.14.x
MLflow mlflow/server/auth package (authorization middleware)
MLflow deployments exposing the runs/log-inputs REST API endpoint

Discovery Timeline

2026-08-17 - CVE-2026-69146 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-69146

Vulnerability Analysis

MLflow's authentication plugin registers permission checks for privileged endpoints in a BEFORE_REQUEST_HANDLERS dispatch table. Each entry maps an API route to a handler that enforces the required permission before the request reaches business logic. The LogInputs route was never registered in this table. As a result, the server processes POST /api/2.0/mlflow/runs/log-inputs requests without validating that the caller holds UPDATE permission on the target run.

An authenticated attacker can submit a run_id belonging to any other user and attach arbitrary DatasetInput records. These records are persisted into the dataset_inputs lineage store. Downstream tooling that reads lineage metadata for reproducibility, audit, or governance purposes will consume the attacker-supplied data as authoritative.

Root Cause

The root cause is an incomplete authorization allow-list. The mlflow/server/auth/__init__.py module enumerates request handlers requiring permission enforcement, and LogInputs (along with LogOutputs) was missing from that enumeration. This is a classic Missing Authorization defect [CWE-862] introduced when new endpoints are added without corresponding entries in the auth middleware registry.

Attack Vector

Exploitation requires only a valid MLflow account on the target tracking server. The attacker sends a crafted HTTP POST to the log-inputs endpoint with a victim's run_id and a chosen dataset payload. No user interaction, elevated privileges, or local access are required.

python

     ListScorerVersions,
     ListWorkspaces,
     LogBatch,
+    LogInputs,
     LogLoggedModelParamsRequest,
     LogMetric,
     LogModel,
+    LogOutputs,
     LogParam,
     QueryTraceMetrics,
     RegisterScorer,

Source: MLflow commit 5c34aec. The patch adds LogInputs and LogOutputs to the authorization handler registry, forcing update-run permission checks before the request executes.

Detection Methods for CVE-2026-69146

Indicators of Compromise

HTTP POST requests to /api/2.0/mlflow/runs/log-inputs where the authenticated user identity differs from the owner of the referenced run_id.
Unexpected additions to dataset_inputs metadata on runs, especially entries referencing datasets outside the run's project scope.
Access log entries showing repeated log-inputs calls enumerating sequential or foreign run_id values.

Detection Strategies

Correlate MLflow application logs with the tracking store to flag LogInputs calls where the requester does not match the run creator.
Baseline normal dataset lineage patterns per project and alert on divergence in DatasetInput record volume or source.
Review recent commits to mlflow_experiments and dataset_inputs tables for entries created by unexpected users.

Monitoring Recommendations

Enable verbose access logging on the MLflow tracking server and forward logs to a centralized analytics platform.
Track version strings served by MLflow instances to identify deployments still running 3.13.0 through 3.14.x.
Audit MLflow user accounts and rotate tokens for any users showing anomalous API activity during the exposure window.

How to Mitigate CVE-2026-69146

Immediate Actions Required

Upgrade all MLflow tracking servers to version 3.15.0 or later.
Inventory MLflow deployments and identify instances running 3.13.0 through 3.14.x.
Review dataset_inputs lineage records created during the vulnerable window and validate them against expected pipeline history.
Restrict network access to MLflow tracking servers so only trusted clients can reach the REST API.

Patch Information

The fix is available in MLflow release v3.15.0, delivered through pull request #24291 and committed in 5c34aec. Full details are in the GitHub Security Advisory GHSA-3p64-6gvh-82v5.

Workarounds

Place MLflow behind a reverse proxy that blocks or authorizes POST /api/2.0/mlflow/runs/log-inputs based on caller identity and target run_id ownership.
Disable multi-tenant use of the tracking server until patching is complete, limiting access to a single trusted user or group.
Take periodic backups of the tracking database so tampered lineage metadata can be reconciled or restored.

bash

# Upgrade MLflow to the patched release
pip install --upgrade "mlflow>=3.15.0"

# Verify the installed version
mlflow --version