MLflow Patches Auth Bypass in LogInputs Endpoint (CVE-2026-69146)
A medium-severity vulnerability in MLflow's built-in basic-auth plugin allows any authenticated user to inject arbitrary dataset records into another user's run via the LogInputs endpoint, according to a GitHub security advisory . Tracked…
MLflow Patches High-Severity Auth Bypass in CreateModelVersion (CVE-2026-69148)
MLflow disclosed a high-severity vulnerability, tracked as CVE-2026-69148 and GHSA-gqch-g4w5-7qcw, in which the CreateModelVersion API's source validation fails to check READ permission on a referenced run_id . An authenticated user can…
dbt Blog: Warehouse-Based Transcript Modeling Cut AI Token Costs 20x vs. Gong API
A post on dbt's official blog describes how modeling Gong call transcripts inside the data warehouse using dbt reduced AI-related token costs by 20x compared with pulling data directly through Gong's API . The approach replaced repeated…
Critical Unauthenticated SSRF in MLflow Webhooks Patched in 3.15.0
MLflow versions prior to 3.15.0 carry a critical unauthenticated server-side request forgery (SSRF) vulnerability in the model-registry webhooks API, tracked as CVE-2026-64849 and GHSA-7gwp-5pfp-969j . The fix ships in MLflow 3.15.0 . The…