SEC-ML-002 — Enforce MLflow resource authorization consistently
| Field | Value |
|---|---|
| Status | Open finding; source-verified; cross-user test pending |
| Severity | Critical |
| Components | sparqd/bff-api, MLflow, sparqd/oqullus |
| Associated issues | Not opened pending finding review |
Concrete observed case
BFF filters non-admin experiment and model lists by owner tags and applies owner checks to selected detail, version, and artifact paths. Other paths accept an experiment name, caller-supplied experiment IDs, run ID, or model name and return run search, run details, metric history, traces, or model details without the same resource check.
AutoML further uses run and experiment ownership metadata that does not match BFF's filtering convention.
Expected condition
One policy engine resolves every MLflow experiment, run, artifact, registered model, and version to an authorized workspace/user scope before returning metadata or content. MLflow's own permissions and BFF policy must agree.
Why it matters
Protecting a list but not a direct lookup permits metadata disclosure when a name or ID is learned elsewhere. Route-by-route checks are easy to omit as the MLflow surface grows.
Existing controls and workarounds
Authentication and selected BFF owner checks reduce accidental discovery. Administrators can inspect all resources by design. These controls do not prove authorization for every direct resource path.
Alternatives considered
- Recommended: enforce canonical MLflow permissions at the backend and use BFF as a consistent policy-aware facade.
- Centralize all BFF resource resolution and authorization if MLflow policy cannot express the product model.
- UI filtering — rejected because direct API calls bypass it.
Component involvement
- BFF applies the same authorization middleware to every route and nested resource.
- MLflow owns experiment/model permissions and artifact access enforcement.
- Oqullus treats forbidden and not-found outcomes consistently.
Reproduction and verification
Follow ML-S007.
Resolution conditions
Close when the cross-user matrix denies every unauthorized list and direct lookup, including nested run, metric, trace, version, and artifact operations.
Validation and blockers
The inconsistent source checks are confirmed. Controlled two-user live evidence and the intended workspace ownership model remain pending.