MLflow: model version creation reads another user's run artifacts without READ permission

Impact

CreateModelVersion accepts a run_id or model_id whose validation only checks path containment, so an authenticated user can register a model version pointing at another user's artifact directory and then pull its contents through GET /model-versions/get-artifact without holding READ on that run. On a shared GPU cluster the MLflow artifact store is where checkpoints, training data samples, evaluation outputs and whatever secrets got logged along the way end up, and per-user permissions are the only thing separating teams inside one tracking server. This is cross-tenant read of model artifacts, not code execution — the record rates confidentiality high with limited integrity impact.

Who can reach it

Any authenticated MLflow user who can call CreateModelVersion against the tracking server. Requires knowing or guessing a target run_id or model_id; no elevated role needed.

What to do

Upgrade MLflow to 3.15.0 and restart the tracking server — a service restart, no GPU node maintenance. If the upgrade has to wait, treat artifact access on that server as effectively shared across all authenticated users and move anything sensitive out of the artifact store; the linked commit and PR show the added source ownership check.

References