Skip to content
OpenAdvisories
High WID-SEC-2026-4316 6 CVEs

MLflow: Mehrere Schwachstellen

Published Nov 3, 2026 · Updated Nov 3, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in MLflow ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen und vertrauliche Informationen offenzulegen.

Product

MLflow ist eine Open-Source-Plattform zur Verwaltung des gesamten Machine-Learning-Lebenszyklus, einschließlich Experimenten, Reproduzierbarkeit und Bereitstellung.

Vulnerabilities 6

  • High 8.2
    CVE-2026-118628

    MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability

    MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is not required to exploit this vulnerabili…

    MLflow MLflow
  • High 7.8
    CVE-2026-118623

    MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

    MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulne…

    MLflow MLflow
  • High 7.8
    CVE-2026-118627

    MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

    MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerabil…

    MLflow MLflow
  • Medium 6.3
    CVE-2026-118625

    MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability

    MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw…

    MLflow MLflow
  • Medium 5.4
    CVE-2026-118624

    MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability

    MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability.…

    MLflow MLflow
  • Medium 5.4
    CVE-2026-118626

    MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

    MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specif…

    MLflow MLflow

Revision history

  1. #1

    Initiale Fassung

References