Mlflow vulnerabilities

Products

• Mlflow/mlflow 55
• Mlflow 41

Newest

• mlflow MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability CVE-2026-118628 8.2 HighNovember 3, 2026
• mlflow MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2026-118627 7.8 HighNovember 3, 2026
• mlflow MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability CVE-2026-118626 5.4 MediumNovember 3, 2026
• mlflow MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability CVE-2026-118625 6.3 MediumNovember 3, 2026
• mlflow MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability CVE-2026-118624 5.4 MediumNovember 3, 2026
• mlflow MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability CVE-2026-118623 7.8 HighNovember 3, 2026
• mlflow MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules CVE-2026-116692 Public exploitFix available 9.8 CriticalOctober 27, 2026
• mlflow MLflow CrewAI autologging records LLM provider API keys in logged trace spans CVE-2026-116691 Fix available 6.5 MediumOctober 27, 2026
• mlflow MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source CVE-2026-116690 Fix available 7.5 HighOctober 27, 2026
• mlflow MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints CVE-2026-115886 Fix available 6.5 MediumOctober 23, 2026
• mlflow MLflow 3.17.1 and prior Path Traversal via Trace ID API CVE-2026-53995 Public exploitFix available 8.8 HighOctober 19, 2026
• mlflow CVE-2026-96804 CVE-2026-96804 8.8 HighSeptember 23, 2026
• mlflow MLflow dspy bypasses pickle deserialization control CVE-2026-96775 8.8 HighSeptember 23, 2026
• mlflow Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer,... CVE-2026-79721 8.6 HighSeptember 8, 2026
• mlflow MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth CVE-2026-69146 Fix available 6.5 MediumAugust 17, 2026
• mlflow MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id CVE-2026-69148 Fix available 7.1 HighAugust 17, 2026
• lfprojects mlflow MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) CVE-2026-64849 In KEVPublic exploitFix available EPSS 10.0% 9.3 CriticalAugust 17, 2026
• mlflow mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint CVE-2026-71211 Public exploit 7.1 HighAugust 5, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Authorization Bypass in mlflow/mlflow CVE-2026-8147 Fix available 8.1 HighJuly 2, 2026
• lfprojects mlflow MLflow Experiment-scoped Label Schema CRUD API authorization CVE-2026-13484 Fix available 2.3 LowJune 28, 2026
• lfprojects mlflow MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash CVE-2026-10803 Fix available 2.0 LowJune 4, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Environment Variable Resolution Vulnerability in mlflow/mlflow CVE-2026-4035 Fix available 9.1 CriticalJune 3, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Improper Access Control in mlflow/mlflow CVE-2026-3198 Fix available 6.5 MediumJune 2, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Missing Authorization Validation in mlflow/mlflow CVE-2026-2651 Fix available 9.0 CriticalMay 25, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Authorization Bypass in SearchModelVersions in mlflow/mlflow CVE-2026-2734 Fix available 6.5 MediumMay 21, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Improper Origin Validation in mlflow/mlflow CVE-2026-2611 Fix available 9.6 CriticalMay 19, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow CVE-2026-4137 Fix available 7.0 HighMay 18, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Authentication Bypass in mlflow/mlflow CVE-2026-2652 Fix available EPSS 20.8% 8.6 HighMay 15, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more +4 more Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow CVE-2026-2614 Fix available 7.5 HighMay 11, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Server-Side Request Forgery (SSRF) in mlflow/mlflow CVE-2026-2393 Fix available 7.1 HighMay 11, 2026
• lfprojects mlflow Authorization Bypass in MLflow AJAX Endpoint CVE-2026-33866 Fix available 5.3 MediumApril 7, 2026
• lfprojects mlflow Stored XSS via unsafe YAML parsing in MLflow CVE-2026-33865 Fix available 5.1 MediumApril 7, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +1 more +3 more Missing Authentication for Critical Function in mlflow/mlflow CVE-2026-0545 9.1 CriticalApril 3, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Command Injection in mlflow/mlflow CVE-2026-0596 Public exploitFix available 9.6 CriticalMarch 31, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Command Injection in mlflow/mlflow CVE-2025-15379 Fix available 10.0 CriticalMarch 30, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Path Traversal Vulnerability in mlflow/mlflow CVE-2025-15036 Fix available 9.6 CriticalMarch 30, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow CVE-2025-15381 Fix available 8.1 HighMarch 27, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Path Traversal Vulnerability in mlflow/mlflow CVE-2025-15031 Fix available 8.1 HighMarch 18, 2026
• lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 more Command Injection in mlflow/mlflow CVE-2025-14287 Fix available 7.5 HighMarch 15, 2026
• mlflow, red hat openshift ai (rhoai) +1 more MLflow Use of Default Password Authentication Bypass Vulnerability CVE-2026-2635 Fix available 9.8 CriticalFebruary 20, 2026
• mlflow, red hat openshift ai (rhoai) +1 more MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability CVE-2026-2033 Fix available 8.1 HighFebruary 20, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Privilege Escalation in mlflow/mlflow CVE-2025-10279 Fix available 7.0 HighFebruary 2, 2026
• lfprojects mlflow, mlflow mlflow/mlflow +1 more DNS Rebinding Vulnerability in mlflow/mlflow CVE-2025-14279 Fix available 8.1 HighJanuary 12, 2026
• lfprojects mlflow MLflow Weak Password Requirements Authentication Bypass Vulnerability CVE-2025-11200 Fix available 8.1 HighOctober 29, 2025
• lfprojects mlflow MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability CVE-2025-11201 Public exploitFix available EPSS 26.3% 8.1 HighOctober 29, 2025
• lfprojects mlflow MLFlow SSRF via gateway_proxy_handler CVE-2025-52967 Fix available 5.8 MediumJune 23, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Denial of Service through Batched Queries in GraphQL in mlflow/mlflow CVE-2025-0453 Fix available EPSS 11.3% 5.9 MediumMarch 20, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Weak Password Requirements in mlflow/mlflow CVE-2025-1474 Fix available 3.8 LowMarch 20, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more CSRF in mlflow/mlflow CVE-2025-1473 Fix available 5.4 MediumMarch 20, 2025
• lfprojects mlflow, mlflow mlflow/mlflow +1 more Path Traversal in mlflow/mlflow CVE-2024-8859 Fix available 7.5 HighMarch 20, 2025
• Show olderLoading…