CVE-2026-69146 mlflow CVE debrief

Who should care

Defenders managing MLflow deployments, particularly those using versions 3.13.0 to 3.15.0, should assess their exposure and apply the necessary patches to prevent unauthorized data injection.

Why it matters

CVE-2026-69146 is a medium-severity vulnerability in MLflow that allows authenticated users to inject malicious data into dataset lineage metadata. Defenders should verify their deployments for exposure, prioritize patching, and monitor for suspicious activity.

• Potential for unauthorized data injection into dataset lineage metadata.
• Need for verification of MLflow deployments for exposure.
• Priority for applying patches to prevent exploitation.
• Importance of monitoring for suspicious data injections.

Technical summary

The vulnerability arises from the absence of LogInputs in BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, affecting MLflow versions 3.13.0 to 3.15.0. This allows any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. The issue has been fixed in version 3.15.0, and defenders should prioritize verifying their MLflow deployments for exposure and apply the patch to prevent unauthorized data injection.

Defensive priority

Defenders should prioritize verifying their MLflow deployments for exposure and apply the patch from version 3.15.0 to prevent unauthorized data injection.

Recommended defensive actions

• Verify MLflow deployments for exposure by checking if versions 3.13.0 to 3.15.0 are in use.
• Apply the patch by upgrading to version 3.15.0 or later.
• Monitor for unauthorized data injections into dataset lineage metadata.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. Additional information on potential exploitation or affected systems is limited. Defenders should verify MLflow deployments for exposure, particularly those using versions 3.13.0 to 3.15.0, and monitor for suspicious activity. The absence of LogInputs in BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package allows any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.