MLflow vulnerabilities

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function accepts a user-controlled `url` parameter without validation, allowing an attacker to force the MLflow backend to send HTTP requests to internal services or arbitrary external servers.

A vulnerability in MLflow versions up to 3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded.

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. Even with basic authentication enabled, any network client can submit, read, search, and cancel jobs without credentials.

A command injection vulnerability exists in MLflow version 3.8.0 in the model serving container initialization code. The `_install_model_dependencies_to_env()` function directly interpolates dependencies from the `python_env.yaml` file into a shell command without sanitization, allowing an attacker to execute arbitrary commands by supplying a malicious model artifact.

A path traversal vulnerability exists in the `extract_archive_to_dir` function of mlflow before version 3.7.0. Lack of tar member path validation allows an attacker to overwrite arbitrary files or escalate privileges.

A vulnerability in MLflow's pyfunc extraction process allows arbitrary file writes due to improper handling of tar archive entries. The use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory.

MLflow prior to 3.15.0 allows authenticated users to create a model version referencing another user's artifact directory and read files without the required READ permission.

MLflow is an open source AI engineering platform. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.

In MLflow versions prior to 3.14.0, when authentication is enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation.

In MLflow up to version 4666cffc7912ea606d592fc38d6a75e2935f65e7, a missing authorization vulnerability was found in the Experiment-scoped Label Schema CRUD API. This flaw allows remote manipulation of data without proper authentication, though exploitation is difficult due to high attack complexity.

In MLflow up to version 3.10.0, a flaw in mlflow.data.digest_utils causes use of a weak hash function. The attack is local, high complexity, difficult to exploit, but an exploit has been published.

Vulnerability in mlflow/mlflow prior to 3.11.0 allows environment variable resolution in AI Gateway secrets, leading to exfiltration of sensitive server-side credentials.

MLflow 3.9.0 with basic-auth enabled fails to enforce authorization for Gateway API endpoints: ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions. Any authenticated user, regardless of permissions, can enumerate all gateway secrets, endpoint configurations, and model definitions.

In mlflow/mlflow up to version 3.9.0, the SearchModelVersions REST API and GraphQL endpoints lack proper authorization checks, allowing any authenticated user to enumerate all model versions. Fixed in version 3.10.0.

In mlflow/mlflow prior to version 3.11.0, functions creating temporary directories set insecure permissions (0o777 and 0o770). This allows a local attacker to tamper with model artifacts, leading to arbitrary code execution upon deserialization via cloudpickle.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue occurs when a CreateModelVersion request includes the tag mlflow.prompt.is_prompt, which bypasses source path validation. The get_model_version_artifact_handler() function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise.

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization, allowing an attacker to execute arbitrary commands.

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments.

A command injection vulnerability exists in mlflow/mlflow before version 3.7.0 in the `mlflow/sagemaker/__init__.py` file. Attackers can supply malicious container image names via the `--container` parameter, which are directly interpolated into shell commands executed by `os.system()`, allowing arbitrary command execution.

A vulnerability in MLflow allows remote attackers to bypass authentication due to hard-coded default credentials in the basic_auth.ini file. No authentication is required to exploit this flaw, which can lead to arbitrary code execution in the context of the administrator.

A directory traversal vulnerability in MLflow Tracking Server allows remote code execution via improper validation of artifact file paths. The flaw enables unauthenticated attackers to execute arbitrary code in the context of the service account.