MLflow-Vuln

Vuln replication-mlflow ver 2.1.1-prep by Saima.pdf MLflow-Vulnerability MLflow LFI/RFI Vulnerability -CVE-2023-1177 - Reproduced One of the most popular tools in a ML system is MLflow that is used for managing end-to-end machine learning lifecycle. I tested the security of MLflow and reproduced ...

CVE-2024-37054-MLflow-reverse-shell

Tools & Files File| Purpose ---|--- generatemodel.py| Generates malicious model.pkl with reverse shell payload uploadmodel.py| Uploads pickle to MLflow and promotes it to Production sample.csv| CSV file used to trigger the /predict endpoint Usage 1. Generate the malicious pickle Edit...

GHSA-2G95-WG33-C5X2 vulnerabilities

Vulnerabilities for packages: mlflow, mlflow-fips...

GHSA-CRV4-6MHJ-J5JH vulnerabilities

Vulnerabilities for packages: mlflow, mlflow-fips...

GHSA-JQC4-5CVW-7W85 vulnerabilities

Vulnerabilities for packages: mlflow, mlflow-fips...

CVE-2026-112906 vulnerabilities

Vulnerabilities for packages: mlflow, mlflow-fips...

CVE-2026-112937 vulnerabilities

Vulnerabilities for packages: mlflow, mlflow-fips...

CVE-2026-112914 vulnerabilities

Vulnerabilities for packages: mlflow, mlflow-fips...

CVE-2026-0596-Reproduction

Below is a structured, markdown-formatted vulnerability research report tailored for a GitHub repository layout such as a README.md or a security-labs write-up. It outlines the context, architecture, reproduction steps, and remediation strategies based on your lab findings. CVE-2026-0596: Arbitra...

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

GHSA-M65P-9J7Q-6W33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in...

GHSA-J7QQ-VR8C-XVW3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

Summary mlflow.crewai.autolog leaks CrewAI LLM provider API keys into MLflow trace telemetry. When a CrewAI Agent is instrumented with MLflow autologging, MLflow serializes the agent's dict and converts its fields to strings. The llm field contains the CrewAI LLM object, whose string representati...

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

Summary MLflow 3.12.0 introduced registration and deserialization support for third-party scorers in OSS MLflow. During scorer deserialization, the server accepts a request-controlled Python module path beneath one of four allowed package prefixes, imports that module, obtains a request-controlle...

CVE-2026-116692

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRDPARTYSCORERALLOWEDMODULES rather than...

CVE-2026-116690

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in createmodelversion accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and...

CVE-2026-116691

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog records CrewAI Agent objects without consistently sanitizing nested credential-bearing values...

CVE-2026-116692

The MLflow AI engineering platform is vulnerable to Remote Code Execution (RCE) in versions 3.12.0rc0 through 3.17.0 due to a flaw in third-party scorer deserialization located in mlflow/genai/scorers/base.py. The system incorrectly accepts descendants of THIRD_PARTY_SCORER_ALLOWED_MODULES instea...

EUVD-2026-111383

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRDPARTYSCORERALLOWEDMODULES rather than...

CVE-2026-116692 MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of THIRDPARTYSCORERALLOWEDMODULES rather than...