MLflow: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Summary

Product

Vulnerabilities 2

• High 7.5
  CVE-2026-116690 Scanner template

  MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source

  MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when …

  MLflow MLflow mlflow PyPI
  Oct 27, 2026
• Medium 6.5
  CVE-2026-116691

  MLflow CrewAI autologging records LLM provider API keys in logged trace spans

  MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. m…

  MLflow MLflow mlflow PyPI
  Oct 27, 2026

Revision history

1. 2026-10-28 #2

   CVE aufgenommen

2. 2026-10-12 #1

   Initiale Fassung

References

• GitHub Security Advisory GHSA-j7qq-vr8c-xvw3 vom 2026-10-12
  https://github.com/mlflow/mlflow/security/advisories/GHSA-j7qq-vr8c-xvw3
• GitHub Security Advisory GHSA-m65p-9j7q-6w33 vom 2026-10-12
  https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33