Skip to content

Product

lfprojects mlflow vulnerabilities

78 published CVES affecting lfprojects mlflow, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
78
Critical
19
High
46
Medium
10
Low
3
Unscored
0
CISA KEV
1

Latest lfprojects mlflow CVEs

Newest publication first · page 1 of 4

  1. CVE-2026-64849 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

    Published
    CriticalCVSS 9.3 EPSS 10.0% CISA KEV added 2026-08-19 Exploited in the wild

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py...

  2. CVE-2026-8147 Authorization Bypass in mlflow/mlflow

    Published
    HighCVSS 8.1 EPSS 0.55%

    In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, a...

  3. CVE-2026-13484 MLflow Experiment-scoped Label Schema CRUD API authorization

    Published
    LowCVSS 2.3 EPSS 0.50%

    A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack rem...

  5. CVE-2026-4035 Environment Variable Resolution Vulnerability in mlflow/mlflow

    Published
    HighCVSS 7.7 EPSS 0.52%

    A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the...

  6. CVE-2026-3198 Improper Access Control in mlflow/mlflow

    Published
    MediumCVSS 6.5 EPSS 0.24%

    MLflow 3.9.0 with basic-auth (--app-name basic-auth) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the BEFORE_REQUEST_HANDLERS dictionary in mlflow/server/auth/__init__.py does not include entries for ListGatewaySecretInfos, ListGa...

  7. CVE-2026-2651 Missing Authorization Validation in mlflow/mlflow

    Published
    CriticalCVSS 9.0 EPSS 0.35%

    A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the --serve-artifacts mode is enabled. The authorization logic does not enforce resource-level permission checks for /mlflow-artifacts/mpu/* endpoints, enabling at...

  8. CVE-2026-2734 Authorization Bypass in SearchModelVersions in mlflow/mlflow

    Published
    MediumCVSS 6.5 EPSS 0.44%

    In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions acr...

  9. CVE-2026-2611 Improper Origin Validation in mlflow/mlflow

    Published
    CriticalCVSS 9.6 EPSS 0.38%

    In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim'...

  11. CVE-2026-2652 Authentication Bypass in mlflow/mlflow

    Published
    HighCVSS 8.6 EPSS 20.8%

    A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (--app-name basic-auth) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authen...

  13. CVE-2026-2393 Server-Side Request Forgery (SSRF) in mlflow/mlflow

    Published
    HighCVSS 7.1 EPSS 0.29%

    A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The _create_webhook() function in mlflow/server/handlers.py accepts a user-controlled url parameter without validation, and the _send_webhook_request() function in mlflow/webhooks/deliver...

  14. CVE-2026-33866 Authorization Bypass in MLflow AJAX Endpoint

    Published
    MediumCVSS 5.3 EPSS 0.38%

    MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are no...

  15. CVE-2026-33865 Stored XSS via unsafe YAML parsing in MLflow

    Published
    MediumCVSS 5.1 EPSS 0.23%

    MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI...

  16. CVE-2026-0545 Missing Authentication for Critical Function in mlflow/mlflow

    Published
    CriticalCVSS 9.8 EPSS 4.4%

    In mlflow/mlflow, the FastAPI job endpoints under /ajax-api/3.0/jobs/* are not protected by authentication or authorization when the basic-auth app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (MLFLOW_SERVER_ENABLE_JOB_E...

  17. CVE-2026-0596 Command Injection in mlflow/mlflow

    Published
    HighCVSS 7.8 EPSS 1.4%

    A command injection vulnerability exists in mlflow/mlflow when serving a model with enable_mlserver=True. The model_uri is embedded directly into a shell command executed via bash -c without proper sanitization. If the model_uri contains shell metacharacters, such as $() or backt...

  18. CVE-2025-15379 Command Injection in mlflow/mlflow

    Published
    CriticalCVSS 10.0 EPSS 2.4%

    A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the _install_model_dependencies_to_env() function. When deploying a model with env_manager=LOCAL, MLflow reads dependency specifications from the model artifact's pyt...

  19. CVE-2025-15036 Path Traversal Vulnerability in mlflow/mlflow

    Published
    CriticalCVSS 10.0 EPSS 0.59%

    A path traversal vulnerability exists in the extract_archive_to_dir function within the mlflow/pyfunc/dbconnect_artifact_cache.py file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths...

  21. CVE-2025-15031 Path Traversal Vulnerability in mlflow/mlflow

    Published
    CriticalCVSS 9.1 EPSS 0.85%

    A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of tarfile.extractall without path validation enables crafted tar.gz files containing .. or absolute paths to escape the i...

  22. CVE-2025-14287 Command Injection in mlflow/mlflow

    Published
    HighCVSS 8.8 EPSS 1.7%

    A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/__init__.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without prop...

  23. CVE-2025-10279 Privilege Escalation in mlflow/mlflow

    Published
    HighCVSS 7.0 EPSS 0.24%

    In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the /tmp directory to exploit a race condition and overwrite .py fil...

  24. CVE-2025-14279 DNS Rebinding Vulnerability in mlflow/mlflow

    Published
    HighCVSS 8.1 EPSS 0.22%

    MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.