VECTOR WIREAI INTELLIGENCE
⌘K
NVDA$1,847+3.2%MSFT$512+1.1%GOOGL$199-0.4%META$728+2.7%AMD$184-1.2%TSM$212+0.6%PLTR$98+4.1%AI IDX4,821+1.9%
PKT
SEEDRefresh Models —Deals —Regulatory —Sources —
Monday, August 17, 20261 min read← AI WIRE

MLflow Patches High-Severity Auth Bypass in CreateModelVersion (CVE-2026-69148)

MLflow version 3.15.0 patches CVE-2026-69148, a high-severity flaw allowing authenticated users to bypass READ permissions and access other users'…

Vector Wire — AI-assisted editorial illustration
ALERTIndustry ProSINGLE SOURCE · via github.com

MLflow disclosed a high-severity vulnerability, tracked as CVE-2026-69148 and GHSA-gqch-g4w5-7qcw, in which the CreateModelVersion API's source validation fails to check READ permission on a referenced run_id1. An authenticated user can reference another user's run_id to create a model version whose artifact URI points at the victim's artifact directory, then read arbitrary files via GET /model-versions/get-artifact, bypassing experiment-level READ permission gates. Versions below 3.15.0 are affected; version 3.15.0 patches the issue.