CVE-2026-2651

A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.

• CWE-862
• CWE-1220

• https://github.com/mlflow/mlflow/commit/d7290811d8f3c95366d80109424edc1fb1ad966fPatch
• https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dcExploit, Third Party Advisory
• https://access.redhat.com/security/cve/CVE-2026-2651
• https://bugzilla.redhat.com/show_bug.cgi?id=2481117
• https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dcExploit, Third Party Advisory
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2651.json

Published

May 25, 2026

Last Modified

Jul 21, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-26477An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows…4.3
• CVE-2026-26478A shell command injection vulnerability in Mobvoi Tichome Mi…9.8
• CVE-2026-2648Heap buffer overflow in PDFium in Google Chrome prior to 145…8.8
• CVE-2026-26483Mettle SendPortal 3.0.1 and earlier contains a stored cross-…6.1
• CVE-2026-2649Integer overflow in V8 in Google Chrome prior to 145.0.7632.…8.8
• CVE-2026-2650Heap buffer overflow in Media in Google Chrome prior to 145.…8.8
• CVE-2026-26514An Argument Injection vulnerability exists in bird-lg-go bef…7.5
• CVE-2026-2652A vulnerability in mlflow/mlflow versions 3.9.0 and earlier …8.6
• CVE-2026-2653A security flaw has been discovered in admesh up to 0.98.5. …7.8
• CVE-2026-2654A weakness has been identified in huggingface smolagents 1.2…9.8
• CVE-2026-2655A vulnerability was detected in ChaiScript up to 6.1.0. The …2.5
• CVE-2026-2656A flaw has been found in ChaiScript up to 6.1.0. This affect…2.5