MLflow npm Package Authorization Bypass: Early Warning
- Severity
- HIGH
- Affected component
- mlflow (npm)
- Affected versions
- < 3.15.0 or < 3.15.0
- Patched version
- Not yet available
An early warning has been issued for an authorization bypass vulnerability in the MLflow npm package. Users of versions below 3.15.0 are reportedly at risk.
What happened
An early warning has been issued for a vulnerability in the MLflow npm package. The issue, tracked as GHSA-3P64-6GVH-82V5, involves an authorization bypass in the LogInputs endpoint. This bypass allows authenticated users to inject arbitrary dataset records into another user's run due to a missing authorization check. The vulnerability affects versions below 3.15.0. It is under investigation and has not been exploited in the wild as of the latest reports.
To assess your exposure, check if your project uses the MLflow npm package and determine the version in use. If your version is below 3.15.0, you are potentially affected by this vulnerability. It is crucial to review your project dependencies and compare them against the affected version range to understand your risk level.
What to do about it
- Upgrade to the latest version of MLflow that includes the fix for this authorization bypass.
- Review your project dependencies to ensure all components are up to date and secure.
- Monitor the primary sources for updates on this vulnerability and any additional mitigation advice.
How 0Day would have caught this
mlflow is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the MLflow npm package and your version is below 3.15.0, you are potentially affected.
What should I do right now?
Upgrade to the latest version of MLflow that includes the fix for this authorization bypass.
Has an official fix been published?
An official fix has been recommended in the latest version of MLflow. Upgrade to ensure you are protected.