MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-69146 · CVE overview and exploitation status

EUVD-2026-60475

GHSA-3p64-6gvh-82v5

BIT-mlflow-2026-69146

cve-program · CVE-2026-69146

• https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5
• https://github.com/mlflow/mlflow/pull/24291
• https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693
• https://github.com/mlflow/mlflow/releases/tag/v3.15.0

euvd · EUVD-2026-60475

• https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5
• https://github.com/mlflow/mlflow/pull/24291
• https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693
• https://github.com/mlflow/mlflow/releases/tag/v3.15.0

nvd · CVE-2026-69146

• https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693
• https://github.com/mlflow/mlflow/pull/24291
• https://github.com/mlflow/mlflow/releases/tag/v3.15.0
• https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5

osv · GHSA-3p64-6gvh-82v5

• https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5
• https://github.com/mlflow/mlflow/pull/24291
• https://github.com/mlflow/mlflow/commit/5c34aec5669e2386b38b5ee0855cd61174e27693
• https://github.com/mlflow/mlflow
• https://github.com/mlflow/mlflow/releases/tag/v3.15.0

No related changes are available here.