Skip to content
OpenAdvisories

Vendor

MLflow

90 known vulnerabilities.

Products

mlflow/mlflow 55 MLflow 35
All Critical High Medium Low Exploited only Public exploit

24 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-116692 Public exploit

    MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PART…

    MLflow MLflow mlflow PyPI
  • Critical 9.3
    CVE-2026-64849 Exploited Public exploit Scanner template EPSS 10%

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflo…

    MLflow MLflow mlflow PyPI
    KEV Aug 19, 2026
  • Critical 9.1
    CVE-2026-4035

    Environment Variable Resolution Vulnerability in mlflow/mlflow

    A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This iss…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.0
    CVE-2026-2651

    Missing Authorization Validation in mlflow/mlflow

    A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.6
    CVE-2026-2611

    Improper Origin Validation in mlflow/mlflow

    In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.1
    CVE-2026-0545 Scanner template

    Missing Authentication for Critical Function in mlflow/mlflow

    In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.6
    CVE-2026-0596 Public exploit

    Command Injection in mlflow/mlflow

    A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacha…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2025-15379

    Command Injection in mlflow/mlflow

    A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.6
    CVE-2025-15036

    Path Traversal Vulnerability in mlflow/mlflow

    A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of valida…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.8
    CVE-2026-2635

    MLflow Use of Default Password Authentication Bypass Vulnerability

    MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists…

    MLflow MLflow mlflow PyPI
  • Critical 10.0
    CVE-2024-0520 Public exploit

    Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

    A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.3
    CVE-2024-3573

    Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow

    mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with emp…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2023-6977 Scanner template

    Path Traversal: '\..\filename'

    This vulnerability enables malicious users to read sensitive files on the server.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.8
    CVE-2023-6975

    Path Traversal: '\..\filename'

    A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.0
    CVE-2023-6940

    Command Injection

    with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.6
    CVE-2023-6753

    Path Traversal in mlflow/mlflow

    Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2023-6709

    Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

    Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.1
    CVE-2023-6014

    MLflow Authentication Bypass

    An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2023-6015

    MLflow Arbitrary File Upload

    MLflow allowed arbitrary files to be PUT onto the server.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2023-6018 Scanner template EPSS 48%

    MLflow Arbitrary File Write

    An attacker can overwrite any file on the server hosting MLflow without any authentication.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2023-3765 Scanner template EPSS 67%

    Absolute Path Traversal in mlflow/mlflow

    Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.8
    CVE-2023-2780 Scanner template

    Path Traversal: '\..\filename' in mlflow/mlflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2023-2356 Scanner template

    Relative Path Traversal in mlflow/mlflow

    Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.3
    CVE-2023-1177 Public exploit Scanner template EPSS 70%

    Path Traversal: '\..\filename' in mlflow/mlflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

    MLflow mlflow/mlflow mlflow PyPI