MLflow Missing Authorization Check on Run Input Logging Endpoint

Technical Analysis

The vulnerability stems from LogInputs being omitted from the BEFORE_REQUEST_HANDLERS authorization middleware in mlflow/server/auth, meaning the POST /api/2.0/mlflow/runs/log-inputs endpoint does not verify that the calling user has UPDATE rights on the target run_id. An authenticated but lower-privileged attacker can supply an arbitrary run_id belonging to another user and inject attacker-controlled DatasetInput records into that run's dataset_inputs lineage metadata. Because MLflow is frequently used as a tracking/orchestration backend for agentic ML workflows (recording datasets, parameters, and artifacts that downstream agents or automated pipelines may trust), this allows metadata/lineage poisoning that could mislead automated decision-making, audit trails, or model governance processes that consume run metadata as ground truth. The flaw crosses a trust boundary between users/tenants within a shared MLflow server rather than between distinct autonomous agents, but it is directly relevant to agent supply-chain integrity since corrupted lineage data could be used to spoof dataset provenance feeding into agent training or evaluation pipelines.

Affected Systems

MLflow

Detection Signatures

• Unexpected POST requests to /api/2.0/mlflow/runs/log-inputs targeting run_ids not owned/created by the requesting user
• Audit logs showing dataset_inputs entries added by users lacking UPDATE permission on the run
• DatasetInput records appearing with inconsistent authorship/timestamps relative to the run's known contributors
• Multiple distinct authenticated identities modifying the same run's lineage metadata in a short window

Remediation Steps

1. 1

   Upgrade MLflow

   Update to MLflow 3.15.0 or later, which adds LogInputs to BEFORE_REQUEST_HANDLERS and enforces proper UPDATE permission checks on the log-inputs endpoint.

2. 2

   Audit existing lineage records

   Review dataset_inputs metadata on sensitive or production runs created between 3.13.0 and 3.15.0 for unauthorized or unexpected entries.

3. 3

   Enforce least-privilege access

   Ensure MLflow authentication/authorization is enabled and users are granted only the minimum run-level permissions needed, reducing blast radius of similar missing-check issues.

4. 4

   Monitor API access patterns

   Add logging/alerting for cross-user run modifications via tracking API endpoints to catch similar authorization gaps in the future.