Authorization Bypass in MLflow AJAX Endpoint
Priority MEDIUM 63CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862.
Summary
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.10.1
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00376 31st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Partial mlflow (PyPI): 3.11.0rc0Red Hat: 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MLflow | Mlflow | up to 3.10.1 | — | No fix listed | CNA |
| — | mlflow (PyPI) | before 3.11.0rc0 | 3.11.0rc0 | Patch available | GHSA-46r5-x6jq-v8g6 |
- Mlflow VendorMLflow Affected up to 3.10.1 Fixed in — No fix listed CNA
- mlflow (PyPI) Vendor— Affected before 3.11.0rc0 Fixed in 3.11.0rc0 Patch available GHSA-46r5-x6jq-v8g6
Remediation
- Fix · GHSA-46r5-x6jq-v8g6 mlflow (PyPI) Fixed in 3.11.0rc0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat OpenShift AI (RHOAI)
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33866
- 2026-10-03 Alias added: GHSA-46r5-x6jq-v8g6
References
Advisory 2
More Mlflow vulnerabilities
- TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
- TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
- TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
- TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
- TI-2023-02603 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-33866 · CVE Program
- CVE-2026-33866 · NVD
- FIRST EPSS
- GHSA-46r5-x6jq-v8g6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-33866 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences