mlflow vulnerabilities (TuxCare)
43 vulnerabilities.
-
mlflowTuxCare MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact 8.8 High -
mlflowTuxCare Authorization Bypass in mlflow/mlflow 8.1 High -
mlflowTuxCare Environment Variable Resolution Vulnerability in mlflow/mlflow 9.1 Critical -
mlflowTuxCare Missing Authorization Validation in mlflow/mlflow 9.0 Critical -
mlflowTuxCare Authorization Bypass in SearchModelVersions in mlflow/mlflow 6.5 Medium -
mlflowTuxCare Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow 7.0 High -
mlflowTuxCare Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow 7.5 High -
mlflowTuxCare Command Injection in mlflow/mlflow 9.6 Critical -
mlflowTuxCare Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow 8.1 High -
mlflowTuxCare Path Traversal Vulnerability in mlflow/mlflow 8.1 High -
mlflowTuxCare Command Injection in mlflow/mlflow 7.5 High -
mlflowTuxCare MLflow Use of Default Password Authentication Bypass Vulnerability 9.8 Critical -
mlflowTuxCare MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability 8.1 High -
mlflowTuxCare Privilege Escalation in mlflow/mlflow 7.0 High -
mlflowTuxCare DNS Rebinding Vulnerability in mlflow/mlflow 8.1 High -
mlflowTuxCare MLflow Weak Password Requirements Authentication Bypass Vulnerability 8.1 High -
mlflowTuxCare MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability 8.1 High -
mlflowTuxCare MLFlow SSRF via gateway_proxy_handler 5.8 Medium -
mlflowTuxCare Weak Password Requirements in mlflow/mlflow 3.8 Low -
mlflowTuxCare Path Traversal in mlflow/mlflow 7.5 High -
mlflowTuxCare Uncontrolled Resource Consumption in mlflow/mlflow 5.3 Medium -
mlflowTuxCare Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf 7.0 High -
mlflowTuxCare Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow 7.5 High -
mlflowTuxCare Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow 5.4 Medium -
mlflowTuxCare MLFlow unsafe deserialization 8.8 High -
mlflowTuxCare MLFlow unsafe deserialization 8.8 High -
mlflowTuxCare MLFlow unsafe deserialization 8.8 High -
mlflowTuxCare MLFlow unsafe deserialization 8.8 High -
mlflowTuxCare MLFlow unsafe deserialization 8.8 High -
mlflowTuxCare Improper Access Control in mlflow/mlflow 5.4 Medium -
mlflowTuxCare Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow 9.3 Critical -
mlflowTuxCare Local File Read via Path Traversal in mlflow/mlflow 7.5 High -
mlflowTuxCare Path Traversal via Parameter Smuggling in mlflow/mlflow 7.5 High -
mlflowTuxCare Path Traversal Vulnerability in mlflow/mlflow 7.5 High -
mlflowTuxCare Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. 7.5 High -
mlflowTuxCare Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. 7.5 High -
mlflowTuxCare Path Traversal: '\..\filename' 10.0 Critical -
mlflowTuxCare Path Traversal: '\..\filename' 9.8 Critical -
mlflowTuxCare Server-Side Request Forgery (SSRF) 8.6 High -
mlflowTuxCare Command Injection 9.0 Critical -
mlflowTuxCare Path Traversal: '\..\filename' in mlflow/mlflow 7.5 High -
mlflowTuxCare Path Traversal in mlflow/mlflow 9.6 Critical -
mlflowTuxCare Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow 10.0 Critical