Lfprojects Mlflow vulnerabilities

• lfprojects mlflow MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) CVE-2026-64849 In KEVPublic exploitFix available EPSS 10.0% 9.3 CriticalAugust 17, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Authorization Bypass in mlflow/mlflow CVE-2026-8147 Fix available 8.1 HighJuly 2, 2026
• lfprojects mlflow MLflow Experiment-scoped Label Schema CRUD API authorization CVE-2026-13484 Fix available 2.3 LowJune 28, 2026
• lfprojects mlflow MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash CVE-2026-10803 Fix available 2.0 LowJune 4, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Environment Variable Resolution Vulnerability in mlflow/mlflow CVE-2026-4035 Fix available 9.1 CriticalJune 3, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Improper Access Control in mlflow/mlflow CVE-2026-3198 Fix available 6.5 MediumJune 2, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Missing Authorization Validation in mlflow/mlflow CVE-2026-2651 Fix available 9.0 CriticalMay 25, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Authorization Bypass in SearchModelVersions in mlflow/mlflow CVE-2026-2734 Fix available 6.5 MediumMay 21, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Improper Origin Validation in mlflow/mlflow CVE-2026-2611 Fix available 9.6 CriticalMay 19, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow CVE-2026-4137 Fix available 7.0 HighMay 18, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Authentication Bypass in mlflow/mlflow CVE-2026-2652 Fix available EPSS 20.8% 8.6 HighMay 15, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more +4 more Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow CVE-2026-2614 Fix available 7.5 HighMay 11, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Server-Side Request Forgery (SSRF) in mlflow/mlflow CVE-2026-2393 Fix available 7.1 HighMay 11, 2026
• lfprojects mlflow Authorization Bypass in MLflow AJAX Endpoint CVE-2026-33866 Fix available 5.3 MediumApril 7, 2026
• lfprojects mlflow Stored XSS via unsafe YAML parsing in MLflow CVE-2026-33865 Fix available 5.1 MediumApril 7, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +1 more +3 more Missing Authentication for Critical Function in mlflow/mlflow CVE-2026-0545 9.1 CriticalApril 3, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Command Injection in mlflow/mlflow CVE-2026-0596 Public exploitFix available 9.6 CriticalMarch 31, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Command Injection in mlflow/mlflow CVE-2025-15379 Fix available 10.0 CriticalMarch 30, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Path Traversal Vulnerability in mlflow/mlflow CVE-2025-15036 Fix available 9.6 CriticalMarch 30, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow CVE-2025-15381 Fix available 8.1 HighMarch 27, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Path Traversal Vulnerability in mlflow/mlflow CVE-2025-15031 Fix available 8.1 HighMarch 18, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Command Injection in mlflow/mlflow CVE-2025-14287 Fix available 7.5 HighMarch 15, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Privilege Escalation in mlflow/mlflow CVE-2025-10279 Fix available 7.0 HighFebruary 2, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more DNS Rebinding Vulnerability in mlflow/mlflow CVE-2025-14279 Fix available 8.1 HighJanuary 12, 2026
• lfprojects mlflow MLflow Weak Password Requirements Authentication Bypass Vulnerability CVE-2025-11200 Fix available 8.1 HighOctober 29, 2025
• lfprojects mlflow MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability CVE-2025-11201 Public exploitFix available EPSS 26.3% 8.1 HighOctober 29, 2025
• lfprojects mlflow MLFlow SSRF via gateway_proxy_handler CVE-2025-52967 Fix available 5.8 MediumJune 23, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Denial of Service through Batched Queries in GraphQL in mlflow/mlflow CVE-2025-0453 Fix available EPSS 11.3% 5.9 MediumMarch 20, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Weak Password Requirements in mlflow/mlflow CVE-2025-1474 Fix available 3.8 LowMarch 20, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more CSRF in mlflow/mlflow CVE-2025-1473 Fix available 5.4 MediumMarch 20, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Path Traversal in mlflow/mlflow CVE-2024-8859 Fix available 7.5 HighMarch 20, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Uncontrolled Resource Consumption in mlflow/mlflow CVE-2024-6838 Fix available 5.3 MediumMarch 20, 2025
• lfprojects mlflow Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf CVE-2024-27134 Fix available 7.0 HighNovember 25, 2024
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow CVE-2024-2928 Public exploitFix available EPSS 21.8% 7.5 HighJune 6, 2024
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Remote Code Execution due to Full Controlled File Write in mlflow/mlflow CVE-2024-0520 Public exploitFix available 10.0 CriticalJune 6, 2024
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow CVE-2024-3099 Fix available 5.4 MediumJune 6, 2024
• lfprojects mlflow MLFlow improper input validation CVE-2024-37061 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37060 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37059 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37058 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37057 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37056 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37055 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37054 Public exploitFix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37053 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow MLFlow unsafe deserialization CVE-2024-37052 Fix available 8.8 HighJune 4, 2024
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Improper Access Control in mlflow/mlflow CVE-2024-4263 Fix available 5.4 MediumMay 16, 2024
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Path Traversal Bypass in mlflow/mlflow CVE-2024-3848 Fix available EPSS 43.0% 7.5 HighMay 16, 2024
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow CVE-2024-3573 Fix available 9.3 CriticalApril 16, 2024
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Local File Read via Path Traversal in mlflow/mlflow CVE-2024-1594 Fix available 7.5 HighApril 16, 2024
• Show olderLoading…