MLflow Patches Auth Bypass in LogInputs Endpoint (CVE-2026-69146)
A medium-severity vulnerability in MLflow's built-in basic-auth plugin allows any authenticated user to inject arbitrary dataset records into another user's run via the LogInputs endpoint, according to a GitHub security advisory.…
MLflow Patches High-Severity Auth Bypass in CreateModelVersion (CVE-2026-69148)
MLflow disclosed a high-severity vulnerability, tracked as CVE-2026-69148 and GHSA-gqch-g4w5-7qcw, in which the CreateModelVersion API's source validation fails to check READ permission on a referenced run_id. An authenticated use…
dbt Blog: Warehouse-Based Transcript Modeling Cut AI Token Costs 20x vs. Gong API
A post on dbt's official blog describes how modeling Gong call transcripts inside the data warehouse using dbt reduced AI-related token costs by 20x compared with pulling data directly through Gong's API. The approach replaced rep…
Critical Unauthenticated SSRF in MLflow Webhooks Patched in 3.15.0
MLflow versions prior to 3.15.0 carry a critical unauthenticated server-side request forgery (SSRF) vulnerability in the model-registry webhooks API, tracked as CVE-2026-64849 and GHSA-7gwp-5pfp-969j. The fix ships in MLflow 3.15.…