MLflow XSS and Auth Bypass Flaws Disclosed

Two vulnerabilities in MLflow allow stored XSS via malicious model artifacts and unauthorized access to experiment artifacts.

CERT Polska coordinated the disclosure of two vulnerabilities affecting MLflow, an open-source machine learning lifecycle platform, both impacting versions through 3.10.1. CVE-2026-33865 is a stored cross-site scripting vulnerability stemming from unsafe parsing of YAML-based MLmodel artifacts in the web interface; an authenticated attacker can upload a malicious MLmodel file that executes a payload when viewed by another user, enabling session hijacking or unauthorized actions on behalf of the victim.

CVE-2026-33866 is an authorization bypass in the AJAX endpoint used to download saved model artifacts. Due to missing access-control checks, a user lacking permissions to a given experiment can directly query the endpoint to retrieve model artifacts they should not be able to access, resulting in unauthorized data exposure.

Both issues were responsibly reported by Sławomir Zakrzewski of AFINE and coordinated through CERT Polska's CVD process. No evidence of active exploitation is mentioned in the report; this is a standard vulnerability disclosure requiring patching by organizations running affected MLflow deployments.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-33865