CVE-2026-2734 PUBLISHED

Authorization Bypass in SearchModelVersions in mlflow/mlflow

Assigner: @huntr_ai
Reserved: 19.02.2026 Published: 21.05.2026 Updated: 21.05.2026

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registered models, regardless of their permission level. The issue arises due to the absence of SearchModelVersions in the BEFORE_REQUEST_VALIDATORS and AFTER_REQUEST_HANDLERS for the REST API, and its omission from GraphQLAuthorizationMiddleware.PROTECTED_FIELDS for GraphQL. This vulnerability can expose sensitive information such as model names, version descriptions, source URIs, tags, and other metadata, potentially revealing proprietary or confidential details in multi-tenant environments. The issue is resolved in version 3.10.0.

Metrics

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Product Status

Vendor mlflow
Product mlflow/mlflow
Versions
  • affected from unspecified to 3.10.0 (excl.)

References

Problem Types

  • CWE-284 Improper Access Control CWE