CVE-2026-10803: MLflow Weak Hash Vulnerability in Dataset Digest Computation

Technical summary

CVE-2026-10803 is a weak cryptography vulnerability (CWE-327, CWE-328) in MLflow's mlflow/data/digest_utils.py module. The Dataset Digest Computation function employs an insufficiently strong hash algorithm, creating a collision or preimage risk under local attack conditions. The vulnerability requires local access (AV:L), high attack complexity (AC:H), and low-level user privileges (PR:L). While impact is limited to integrity (I) and availability (A) at LOW severity, the published exploit reduces the bar for reproducing the flaw. The MLflow project has not yet responded to early disclosure via pull request.

Business impact

For organizations relying on MLflow for model data governance, this vulnerability primarily threatens data integrity verification rather than confidentiality. Attackers with local system access could forge dataset digests, potentially corrupting provenance records, triggering false validation failures, or obscuring data lineage in machine learning pipelines. The practical risk is moderate because successful exploitation demands local system access, user-level privileges, and specialized knowledge. Environments using MLflow in air-gapped or tightly controlled development settings face lower risk; those sharing ML infrastructure across teams or enabling untrusted local access warrant closer attention.

Affected systems

MLflow versions 3.10.0 and earlier are affected. Organizations should audit their MLflow deployments to identify installed versions. The vulnerability is specific to the Dataset Digest Computation module; other MLflow functionality is not directly impacted. Systems running the affected versions on multi-user or shared-access systems face elevated risk.

Exploitability

Exploitation requires local system access, user-level authentication, and high technical complexity. An attacker must understand hash function weaknesses and the MLflow digest workflow to craft a meaningful collision or forged digest. A proof-of-concept exploit has been published, which may lower the barrier to entry for skilled attackers but does not make exploitation trivial. The attack surface is limited to local threat actors; remote exploitation is not feasible. The combination of access requirements and complexity places this vulnerability in the 'difficult' category despite public disclosure.

Remediation

Upgrade MLflow to a patched version released after 3.10.0 that addresses weak hash usage in digest_utils.py. Verify the specific patch version against the vendor advisory before deploying. In the interim, restrict local system access to MLflow hosts to trusted users and implement file integrity monitoring on dataset digest outputs to detect tampering. Review access control policies for multi-user ML infrastructure.

Patch guidance

Monitor the LF Projects MLflow repository and security advisories for an updated release that remediates the weak hash implementation in Dataset Digest Computation. Apply patches promptly to systems where multiple users access MLflow or where dataset integrity is critical to compliance workflows. Test patches in a non-production environment first, particularly if your pipelines depend on digest validation. Verify against the vendor advisory that the released version fully addresses CWE-327 and CWE-328 concerns.

Detection guidance

Enable audit logging on MLflow hosts to capture Dataset Digest Computation operations and monitor for unexpected modifications to digest metadata. Use file integrity monitoring (FIM) tools to alert on changes to digest_utils.py or cached digest outputs. Network and host-level anomaly detection should flag unusual patterns in local process access to MLflow data directories. In development environments, periodically verify dataset digest reproducibility to detect silent corruption. Review access logs for users with unusual privileges escalation patterns around dataset operations.

Why prioritize this

CVE-2026-10803 merits monitoring but does not demand emergency action for most organizations. The LOW CVSS score (3.6) reflects limited severity, and the high attack complexity combined with local-only access requirements significantly constrains real-world exploitation. However, prioritization should increase if your organization operates shared ML infrastructure with untrusted local users, relies on dataset digest integrity for compliance validation, or has published models that depend on dataset provenance assurance. Development teams actively using MLflow for model governance should plan an upgrade within a standard patch cycle once a fix is available.

Risk score, explained

The CVSS 3.1 score of 3.6 (LOW) reflects several mitigating factors: local-only attack vector (AV:L), high attack complexity (AC:H), and requirement for low-level user privileges (PR:L). Impact is limited to integrity and availability, with no confidentiality breach. While the weak hash cryptographic flaw is inherently serious in principle, the operational and access constraints prevent widespread exploitation. The published exploit code raises awareness but does not overcome the fundamental access and complexity barriers. Organizations with strict access controls and isolation between users face minimal practical risk.

Frequently asked questions