Skip to content
OpenAdvisories

Vendor

MLflow

89 known vulnerabilities.

Products

mlflow/mlflow 55 MLflow 34
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-116692 Public exploit

    MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRD_PART…

    MLflow MLflow mlflow PyPI
  • High 8.2
    CVE-2026-53995 Public exploit

    MLflow 3.17.1 and prior Path Traversal via Trace ID API

    MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/t…

    MLflow MLflow mlflow PyPI
  • Critical 9.3
    CVE-2026-64849 Exploited Public exploit EPSS 10%

    MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflo…

    MLflow MLflow mlflow PyPI
    KEV Aug 19, 2026
  • High 7.1
    CVE-2026-71211 Public exploit

    mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

    MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/serv…

    MLflow MLflow mlflow PyPI
  • Critical 9.6
    CVE-2026-0596 Public exploit

    Command Injection in mlflow/mlflow

    A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacha…

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.1
    CVE-2025-11201 Public exploit EPSS 26%

    MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

    MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit …

    MLflow MLflow mlflow PyPI
  • High 7.5
    CVE-2024-2928 Public exploit EPSS 22%

    Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

    A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal s…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 10.0
    CVE-2024-0520 Public exploit

    Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

    A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a…

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.8
    CVE-2024-37054 Public exploit

    MLFlow unsafe deserialization

    Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

    MLflow MLflow mlflow PyPI
  • Critical 9.3
    CVE-2023-1177 Public exploit EPSS 70%

    Path Traversal: '\..\filename' in mlflow/mlflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

    MLflow mlflow/mlflow mlflow PyPI