PT-2025-34292 · Microsoft · Azure Databricks

Name of the Vulnerable Software and Affected Versions: Azure Databricks affected versions not specified Description: Improper access control in Azure Databricks can allow an unauthorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information about a...

Microsoft Azure Databricks Access Control Vulnerability

Microsoft Azure Databricks is an open analytics platform from Microsoft Corporation, USA. An access control error vulnerability exists in Microsoft Azure Databricks that stems from improper access control and could lead to elevation of privilege...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: docker-cli, skaffold, aws-eks-pod-identity-agent, cert-manager-cmctl, bento, kyverno-policy-reporter, trufflehog-fips, licenseclassifier, kubernetes-dashboard, nova, helm-docs, k3d, fulcio-fips, yace, newrelic-nri-kube-events, velero-fips,...

databricks-agents (>=1.0.0rc0, <=1.0.0rc1), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.0.0rc3)

mlflow PYPI version =3.0.0rc2, =1.0.0rc0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: SNYK:PYTHON-MLFLOW-10494137...

databricks-agents (>=0.1.0, <=1.0.0rc3), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.1.0rc0)

mlflow PYPI version =3.0.0rc2, =0.1.0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: OSV:GHSA-WXJ7-3FX5-PP9M...

databricks-agents (>=0.1.0, <=1.0.0rc3), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.1.0rc0)

mlflow PYPI version =3.0.0rc2, =0.1.0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: GHSA-WXJ7-3FX5-PP9M...

databricks-session (0.1.11) potentially affected by CVE-2025-52967 via mlflow (2.3.0)

mlflow PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session 0.1.11 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2025-52967 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

azureml-evaluate-mlflow (>=0.0.46, <=47.0.0), cogflow (>=1.2.0, <=1.2.13) +5 more potentially affected by CVE-2025-52967 via mlflow (2.10.2)

mlflow PYPI version 2.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.46, =1.2.0, =0.0.10, =1.2.7, =1.0.0, =0.1.0, =0.1.1 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (1.0.7) potentially affected by CVE-2025-52967 via mlflow (2.11.0)

mlflow PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai 1.0.7 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

autonomize-model-sdk (1.0.4), databricks-genai (>=1.0.8, <=1.0.13) +1 more potentially affected by CVE-2025-52967 via mlflow (2.14.2)

mlflow PYPI version 2.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk 1.0.4 - databricks-genai =1.0.8, =1.0.33, =1.0.37 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-52967 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-52967 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-52967 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-52967 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-agents (>=0.1.0, <=1.0.0rc3), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.1.0rc0)

mlflow PYPI version =3.0.0rc2, =0.1.0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

CVE-2024-49194

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2025-0453 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

autonomize-ml-observability (>=1.1.0b1, <=1.2.7), autonomize-observer (>=0.0.1, <=0.0.5) +5 more potentially affected by CVE-2025-0453 via mlflow (>=3.0.0rc2, <=3.1.0)

mlflow PYPI version =3.0.0rc2, =1.1.0b1, =0.0.1, =0.1.0, =2.5.0, =0.6.7, =0.0.4, =0.0.9b0 Source cves: CVE-2025-0453 Source advisory: SNYK:PYTHON-MLFLOW-9510841...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2024-8859 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...