CVE-2026-2651
MLflow versions up to 3.10.1.dev0 allow attackers to write to other users’ artifact storage when the --serve-artifacts mode is enabled, because the multipart upload endpoints lack proper permission checks.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
MLflow (lfprojects mlflow) versions <=3.10.1.dev0, especially when the --serve-artifacts flag is used.
Real-world impact
An attacker could overwrite or replace artifacts belonging to other users, potentially poisoning a model supply chain or enabling arbitrary code execution when the compromised model is loaded.
Why this severity
The CVSS score of 9 reflects that the vulnerability is network reachable, requires low effort, and allows attackers to modify data, compromise integrity, and potentially execute code, all with user interaction required but still critical.
What to do about it
- 01Upgrade MLflow to version 3.10.0 or later.
- 02Restart the MLflow service to apply the update.
NVD-referenced vendor advisory
Timeline
- May 25, 2026 · May 25, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 14d agoAdvisory updatedThe NVD record was last revised.
- Jul 21, 2026 · 14d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.