# UNDF: UNDF-2026-000000464
# MLflow CWE-407 Scan — CLEAN

**Scan date:** 2026-03-27
**Verdict:** No CWE-407 defects found
**Severity:** N/A

## Scope

| Path | What was checked |
|------|-----------------|
| `mlflow/tracking/` | Experiment/run tracking, fluent API |
| `mlflow/store/tracking/file_store.py` | File-based tracking store, run search |
| `mlflow/store/tracking/sqlalchemy_store.py` | SQL tracking store, log_batch, tag ops |
| `mlflow/store/model_registry/` | Model registry stores |
| `mlflow/utils/search_utils.py` | SearchUtils.filter for runs/experiments |
| `mlflow/projects/_project_spec.py` | Project step dependency resolution |

## Analysis

**SearchUtils.filter** (`search_utils.py:763–772`): Uses `run.data.tags.get(key)` and
`run.data.params.get(key)` — both are dict lookups, O(1). No list membership in inner loops.

**`_log_params`** (`sqlalchemy_store.py:1631`): Uses `existing_params = {p.key: p.value for p in run.params}`
(dict) before the loop — O(1) key check per param. The error-path at line 1616 does a linear
scan but only executes on IntegrityError (rare, not on the hot path).

**`record_logged_model`** (`sqlalchemy_store.py:1961`): `[t for t in run.tags if t.key == MLFLOW_LOGGED_MODELS]`
is O(T) over tags for a single call — not inside a loop, no quadratic composition.

**`_set_tags`** (`sqlalchemy_store.py:1762`): Uses `.in_([t.key for t in tags])` — SQL-level bulk
operation, not Python list membership in a loop.

**Projects** (`_project_spec.py`): Step dependency resolution uses dict-based parameter lookups,
no list membership inside loops.

## Conclusion

MLflow's hot paths use dicts, SQL set operations, and SQLAlchemy queries for all bulk lookups.
No CWE-407 (O(N) linear membership inside a loop) defects found.
