Most recent entries from all

BIT-mlflow-2026-69146 — MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Affected: Bitnami: mlflow

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.

EUVD-2026-355125

fkie_cve-2026-69146

GHSA-3p64-6gvh-82v5 — MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Affected: npm: mlflow

### Summary

When MLflow is deployed with the built-in basic-auth plugin (`--app-name basic-auth`), any authenticated user can inject arbitrary dataset records into another user's run by calling `POST /api/2.0/mlflow/runs/log-inputs`. The `LogInputs` proto handler is absent from the `BEFORE_REQUEST_HANDLERS` map in `mlflow/server/auth/__init__.py`, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run -- such as `POST /api/2.0/mlflow/runs/log-metric` -- correctly return HTTP 403.

### Details

MLflow's basic-auth app gates every HTTP handler through a before-request hook (`_before_request`) that looks up the relevant permission validator in `BEFORE_REQUEST_VALIDATORS`. Validators are built from the `BEFORE_REQUEST_HANDLERS` dictionary, which maps each protobuf request class to a callable. When a class is absent from the dict (or mapped to `None`), `get_before_request_handler` returns `None`, and the resulting entry in `BEFORE_REQUEST_VALIDATORS` is `(path, method): None`.

Inside `_before_request`:

```python # mlflow/server/auth/__init__.py _before_request() if validator := _find_validator(request): # None is falsy -- branch skipped if not validator(): return make_forbidden_response() elif _is_proxy_artifact_path(request.path): # not a proxy path ... # falls through: any authenticated request is allowed ```

The `LogInputs` protobuf class is not present in `BEFORE_REQUEST_HANDLERS`:

``…