This CVE is a registration gap, not a logic error. The LogInputs endpoint in MLflow was added in version 3.13.0 but never registered with the authentication middleware (BEFORE_REQUEST_HANDLERS). For two release cycles, any authenticated user could inject arbitrary DatasetInput records into another user's run lineage — poisoning the provenance chain that downstream model cards, compliance audits, and artifact tracking systems depend on. The fix in 3.15.0 was adding a single line to a list. That's the symptom. The disease is architectural.
MLflow's authentication model is opt-in, not default-deny. New endpoints ship without auth unless a contributor explicitly remembers to add them to the middleware registration list. This is a structural vulnerability — every future endpoint added without that manual step perpetuates the same risk. The CVSS 6.5 score badly understates the real impact: lineage metadata injected during the exposure window persists in stored runs and flows into downstream systems that have no integrity checks. Patching the endpoint closes the injection vector; it doesn't remediate already-poisoned provenance data.
What you should do: First, verify whether your MLflow deployment versions 3.13.0 through 3.15.0 were running in multi-tenant or shared environments — that's where the risk is actual, not theoretical. Second, audit any stored run metadata from that window for unexpected DatasetInput records; treat any lineage from those versions as untrusted until verified. Third, check whether your deployment has disabled auth entirely — some installations do, and this CVE doesn't apply there but the underlying architecture means other endpoints may have the same gap.
What the project should have done (and must do going forward): There should be CI tests asserting that every registered route passes through auth middleware before merge. The contribution guide should require auth registration as a mandatory step, not institutional knowledge. Without structural enforcement — default-deny middleware or automated verification — this pattern will recur on the next endpoint added by a contributor who wasn't told auth registration was mandatory.