Skip to content
OpenAdvisories
Medium · 5.8 CVE-2025-52967 BIT-mlflow-2025-52967EUVD-2025-18888GHSA-wxj7-3fx5-pp9mPYSEC-2025-52

MLFlow SSRF via gateway_proxy_handler

Published Jun 23, 2025 · Updated Jun 23, 2025 · Assigned by mitre

Vendor: LF Projects Product: MLflow Package: mlflow Ecosystem: PyPI

Description

gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.

Affected products

VendorProductAffectedFixed
lfprojects MLflow < 3.1.0 3.1.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI mlflow >= 3.0.0rc0, < 3.1.0 3.1.0 GHSA-wxj7-3fx5-pp9m
PyPI mlflow < 2.22.2 2.22.2 GHSA-wxj7-3fx5-pp9m
PyPI mlflow < 3.1.0 3.1.0 PYSEC-2025-52

Advisories 1

References