Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The validatesourcerun and validatesourcemodel functions in mlflow/server/handlers.py verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission on that run or model. An authenticated MLflow user can therefore reference another user's runid in CreateModelVersion, creating a model version whose artifact URI points at the victim's artifact directory. If the calling user has MANAGE permission on the registered model (which they do after creation), they can then read arbitrary files from the victim's artifact directory via GET /model-versions/get-artifact, bypassing the experiment-level READ permission gate on GET /get-artifact. Details POST /api/2.0/mlflow/model-versions/create is protected: the caller must have UPDATE permission on the registered model. However, the source/runid validation performed inside validatesourcerun only verifies path containment, not caller…
Recommended action: Upgrade to 3.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When MLflow is deployed with the built-in basic-auth plugin (--app-name basic-auth), any authenticated user can inject arbitrary dataset records into another user's run by calling POST /api/2.0/mlflow/runs/log-inputs. The LogInputs proto handler is absent from the BEFOREREQUESTHANDLERS map in mlflow/server/auth/init.py, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run -- such as POST /api/2.0/mlflow/runs/log-metric -- correctly return HTTP 403. Details MLflow's basic-auth app gates every HTTP handler through a before-request hook (beforerequest) that looks up the relevant permission validator in BEFOREREQUESTVALIDATORS. Validators are built from the BEFOREREQUESTHANDLERS dictionary, which maps each protobuf request class to a callable. When a class is absent from the dict (or mapped to None), getbeforerequesthandler returns None, and the resulting entry in BEFOREREQUESTVALIDATORS is (path, method):…
Recommended action: Upgrade to 3.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.