mlflow vulnerabilities (Bitnami)
81 vulnerabilities.
-
mlflowBitnami MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints 6.5 Medium -
mlflowBitnami MLflow 3.17.1 and prior Path Traversal via Trace ID API 8.8 High -
mlflowBitnami Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer,... 8.6 High -
mlflowBitnami MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth 6.5 Medium -
mlflowBitnami MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id 7.1 High -
mlflowBitnami MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) 9.3 Critical -
mlflowBitnami Authorization Bypass in mlflow/mlflow 8.1 High -
mlflowBitnami MLflow Experiment-scoped Label Schema CRUD API authorization 2.3 Low -
mlflowBitnami MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash 2.0 Low -
mlflowBitnami Environment Variable Resolution Vulnerability in mlflow/mlflow 9.1 Critical -
mlflowBitnami Improper Access Control in mlflow/mlflow 6.5 Medium -
mlflowBitnami Missing Authorization Validation in mlflow/mlflow 9.0 Critical -
mlflowBitnami Authorization Bypass in SearchModelVersions in mlflow/mlflow 6.5 Medium -
mlflowBitnami Improper Origin Validation in mlflow/mlflow 9.6 Critical -
mlflowBitnami Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow 7.0 High -
mlflowBitnami Authentication Bypass in mlflow/mlflow 8.6 High -
mlflowBitnami Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow 7.5 High -
mlflowBitnami Server-Side Request Forgery (SSRF) in mlflow/mlflow 7.1 High -
mlflowBitnami Authorization Bypass in MLflow AJAX Endpoint 5.3 Medium -
mlflowBitnami Stored XSS via unsafe YAML parsing in MLflow 5.1 Medium -
mlflowBitnami Command Injection in mlflow/mlflow 9.6 Critical -
mlflowBitnami Command Injection in mlflow/mlflow 10.0 Critical -
mlflowBitnami Path Traversal Vulnerability in mlflow/mlflow 9.6 Critical -
mlflowBitnami Path Traversal Vulnerability in mlflow/mlflow 8.1 High -
mlflowBitnami Command Injection in mlflow/mlflow 7.5 High -
mlflowBitnami Privilege Escalation in mlflow/mlflow 7.0 High -
mlflowBitnami DNS Rebinding Vulnerability in mlflow/mlflow 8.1 High -
mlflowBitnami MLflow Weak Password Requirements Authentication Bypass Vulnerability 8.1 High -
mlflowBitnami MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability 8.1 High -
mlflowBitnami MLFlow SSRF via gateway_proxy_handler 5.8 Medium -
mlflowBitnami Denial of Service through Batched Queries in GraphQL in mlflow/mlflow 5.9 Medium -
mlflowBitnami Weak Password Requirements in mlflow/mlflow 3.8 Low -
mlflowBitnami CSRF in mlflow/mlflow 5.4 Medium -
mlflowBitnami Path Traversal in mlflow/mlflow 7.5 High -
mlflowBitnami Uncontrolled Resource Consumption in mlflow/mlflow 5.3 Medium -
mlflowBitnami Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf 7.0 High -
mlflowBitnami Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow 7.5 High -
mlflowBitnami Remote Code Execution due to Full Controlled File Write in mlflow/mlflow 10.0 Critical -
mlflowBitnami Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow 5.4 Medium -
mlflowBitnami MLFlow improper input validation 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami MLFlow unsafe deserialization 8.8 High -
mlflowBitnami Improper Access Control in mlflow/mlflow 5.4 Medium - Show olderLoading…