CVE-2026-69146

### Summary When MLflow is deployed with the built-in basic-auth plugin (`--app-name basic-auth`), any authenticated user can inject arbitrary dataset records into another user's run by calling `POST /api/2.0/mlflow/runs/log-inputs`. The `LogInputs` proto handler is absent from the `BEFORE_REQUEST_HANDLERS` map in `mlflow/server/auth/__init__.py`, so the before-request hook skips authorization entirely and the request succeeds. Standard write endpoints on the same run -- such as `POST /api/2.0/mlflow/runs/log-metric` -- correctly return HTTP 403. ### Details MLflow's basic-auth app gates every HTTP handler through a before-request hook (`_before_request`) that looks up the relevant permission validator in `BEFORE_REQUEST_VALIDATORS`. Validators are built from the `BEFORE_REQUEST_HANDLERS` dictionary, which maps each protobuf request class to a callable. When a class is absent from the dict (or mapped to `None`), `get_before_request_handler` returns `None`, and the resulting entry in `BEFORE_REQUEST_VALIDATORS` is `(path, method): None`. Inside `_before_request`: ```python # mlflow/server/auth/__init__.py _before_request() if validator := _find_validator(request): # None is falsy -- branch skipped if not validator(): return make_forbidden_response() elif _is_proxy_artifact_path(request.path): # not a proxy path ... # falls through: any authenticated request is allowed ``` The `LogInputs` protobuf class is not present in `BEFORE_REQUEST_HANDLERS`: ```python # mlflow/server/auth/__init__.py BEFORE_REQUEST_HANDLERS dict # LogInputs is absent; all run-write operations below ARE present: LogBatch: validate_can_update_run, LogMetric: validate_can_update_run, SetTag: validate_can_update_run, LogParam: validate_can_update_run, # LogInputs: <missing> ``` The route `/api/2.0/mlflow/runs/log-inputs` (and the identical `/ajax-api/` variant) therefore admits any valid credential, regardless of which experiment or run is targeted. The `LogInputs` h