https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:49:42.798910+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-mlflow-2026-3198 BIT-mlflow-2026-3198 — Improper Access Control in mlflow/mlflow 2026-10-02T14:49:42.865122+00:00

Affected: Bitnami: mlflow

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

 https://cve.radiocsirt.org/vuln/euvd-2026-323885 EUVD-2026-323885 2026-10-02T14:49:42.865182+00:00 EUVD-2026-323885 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3198 fkie_cve-2026-3198 2026-10-02T14:49:42.865199+00:00

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

 https://cve.radiocsirt.org/vuln/ghsa-r5m9-wm49-959f GHSA-r5m9-wm49-959f — MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions 2026-10-02T14:49:42.865225+00:00

Affected: PyPI: mlflow

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

 https://cve.radiocsirt.org/vuln/pysec-2026-2659 PYSEC-2026-2659 — MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions 2026-10-02T14:49:42.865250+00:00

Affected: PyPI: mlflow

MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.