{"action":"Upgrade mlflow to 3.10.0 or later.","affected":[{"fixed":"3.10.0","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2026-2651"],"ecosystem":"PyPI","epss":0.00536,"exploited":false,"fixed_versions":["3.10.0"],"ghsa_id":"GHSA-8c7q-86fq-vvmh","id":"tcs_01M5KF7WPETCWEDDPZ4S588D38","modified_at":"2026-10-06T19:00:43.189915747Z","published_at":"2026-05-26T13:30:39Z","references":["https://osv.dev/vulnerability/GHSA-8c7q-86fq-vvmh","https://nvd.nist.gov/vuln/detail/CVE-2026-2651","https://github.com/mlflow/mlflow/commit/d7290811d8f3c95366d80109424edc1fb1ad966f","https://access.redhat.com/security/cve/CVE-2026-2651","https://bugzilla.redhat.com/show_bug.cgi?id=2481117","https://github.com/advisories/GHSA-8c7q-86fq-vvmh","https://github.com/mlflow/mlflow","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-2220.yaml","https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dc","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2651.json"],"severity":{"label":"critical","score":9},"sources":[{"source":"osv","source_id":"GHSA-8c7q-86fq-vvmh","url":"https://osv.dev/vulnerability/GHSA-8c7q-86fq-vvmh"}],"summary":"MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled"}