CVE-2026-33866
Fixed in a distro release EPSS <1%CVSS 5.3
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.10.1
Products: mlflow
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mlflow | 3.11.0rc0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | mlflow | 3.11.1-r0 |
| Chainguard | mlflow | 3.16.0-r0 |
| Chainguard | mlflow-fips | 3.11.1-r0 |
| Wolfi | mlflow | 3.11.1-r0 |
| Wolfi | mlflow | 3.16.0-r0 |