NPM · AUGUST 2026 · EARLY WARNING

MLflow npm Package Authorization Bypass: Early Warning

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
mlflow (npm)
Affected versions
< 3.15.0 or < 3.15.0
Patched version
Not yet available
GHSA-3P64-6GVH-82V5

An early warning has been issued for an authorization bypass vulnerability in the MLflow npm package. Users of versions below 3.15.0 are reportedly at risk.

What happened

An early warning has been issued for a vulnerability in the MLflow npm package. The issue, tracked as GHSA-3P64-6GVH-82V5, involves an authorization bypass in the LogInputs endpoint. This bypass allows authenticated users to inject arbitrary dataset records into another user's run due to a missing authorization check. The vulnerability affects versions below 3.15.0. It is under investigation and has not been exploited in the wild as of the latest reports.

To assess your exposure, check if your project uses the MLflow npm package and determine the version in use. If your version is below 3.15.0, you are potentially affected by this vulnerability. It is crucial to review your project dependencies and compare them against the affected version range to understand your risk level.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If mlflow is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using the MLflow npm package and your version is below 3.15.0, you are potentially affected.

What should I do right now?

Upgrade to the latest version of MLflow that includes the fix for this authorization bypass.

Has an official fix been published?

An official fix has been recommended in the latest version of MLflow. Upgrade to ensure you are protected.

Sources

Join the 0Day waitlist →

← Back to all threats