A vulnerability, which was classified as problematic, has been found in MLflow up to 3.10.1. Affected by this issue is some unknown functionality of the component AJAX Endpoint. This manipulation causes missing authorization.
This vulnerability is handled as CVE-2026-33866. The attack can be initiated remotely. There is not any exploit available.
