SCA: security update for mlflow (GHSA-3p64-6gvh-82v5)

medium Tenable Cloud Security Plugin ID 446040

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- MLflow is an open source AI engineering platform for agents, large language models, and machine learning
models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the
mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs
for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs
lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0. (CVE-2026-69146)

Solution

Update the mlflow library and its related packages to version 3.15.0 or later.

Plugin Details

Severity: Medium

ID: 446040

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 8/18/2026

Updated: 8/18/2026

Risk Information

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:N

CVSS Score Source: CVE-2026-69146

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/17/2026

Vulnerability Publication Date: 8/17/2026

Reference Information

CVE: CVE-2026-69146

cwe: CWE-862

Detections

Analytics