Skip to content
PrivacyHigh

CVE-2026-69148: MLflow is an open source AI engineering platform for agents, large language models, and machine lear…

Occurred
Aug 17, 2026
Published
Aug 17, 2026
Source
NVD CVE

Summary

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0.

Tags

  • CVE
  • CVE-2026-69148
  • cvss:HIGH

Classification

Category confidence: 90%
Severity confidence: 85%

Rationale: CVE describes unauthorized file access via model versioning vulnerability in MLflow platform.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source