MLflow Broken Object-Level Authorization in Model Version Artifact Access

Technical Analysis

The vulnerability lies in mlflow/server/handlers.py, where _validate_source_run() and _validate_source_model() validate that a supplied path is contained within an expected directory structure but do not verify the requesting user actually has READ access to the referenced run or model. An authenticated attacker can call CreateModelVersion with a crafted run_id or model_id pointing at another user's artifacts, then use GET /model-versions/get-artifact to retrieve files from that unauthorized artifact store. This is a classic broken object-level authorization (BOLA/IDOR) flaw that crosses tenant/user boundaries within a shared MLflow deployment, potentially exposing model weights, datasets, credentials embedded in artifacts, or proprietary training data used by AI agent pipelines.

Affected Systems

MLflow

Detection Signatures

• Log pattern: CreateModelVersion requests with run_id/model_id referencing artifact paths outside the requesting user's owned experiments
• Repeated GET /model-versions/get-artifact calls immediately following CreateModelVersion for cross-user run_ids
• Anomalous access to artifact directories not associated with the calling user's project/team
• Audit for model versions whose source run/model owner differs from the creating user

Remediation Steps

1. 1

   Upgrade MLflow

   Update to MLflow 3.15.0 or later, which fixes the authorization validation gap in CreateModelVersion.

2. 2

   Enforce READ permission checks

   Ensure any custom or proxy authorization layer in front of MLflow independently validates that users have READ access to the source run_id/model_id before allowing model version creation.

3. 3

   Audit existing model versions

   Review model registry entries created prior to patching for cross-user run_id/model_id references and investigate any unauthorized artifact access.

4. 4

   Restrict artifact store access

   Apply least-privilege storage-level ACLs on the underlying artifact backend (S3, GCS, etc.) as defense-in-depth against application-layer authorization bypasses.

5. 5

   Enable audit logging

   Turn on detailed access logging for get-artifact endpoints to detect anomalous cross-user artifact retrieval patterns.