[GHSA-gqch-g4w5-7qcw] MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id

[Fanxy13]

Updates

• Affected products

Comments

The affected package is listed as npm/mlflow, but this advisory describes a flaw in the MLflow Python tracking server. The ecosystem should be PyPI.

Evidence:

• The advisory's own details analyse _validate_source_run / _validate_source_model in mlflow/server/handlers.py, quote Python, and the PoC starts the server with --app-name basic-auth. All of that is the Python package.
• Every reference points at mlflow/mlflow, and the fix is https://github.com/mlflow/mlflow/releases/tag/v3.15.0.
• The stated fixed version 3.15.0 exists on PyPI. On npm, mlflow is an unrelated Node.js API client (~17 KB, single dependency isomorphic-unfetch) whose latest release is 2.0.7, so 3.15.0 is not installable there and the alert cannot be resolved by upgrading.
• An HTTP client of that size cannot contain the server-side authorization check this advisory is about.
• Other MLflow advisories in the database are correctly scoped to PyPI, for example GHSA-7gwp-5pfp-969j and GHSA-2cm6-r77w-6g96.
• The sibling advisory GHSA-3p64-6gvh-82v5, published in the same batch, has the identical problem; [GHSA-3p64-6gvh-82v5] MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth #9154 proposes the same one-word change there.

Net effect as published: npm consumers receive an unfixable false positive, while PyPI consumers of the actually affected package receive no alert for CVE-2026-69148 (HIGH).

🤖 Generated with Claude Code