1529 matches found
PT-2026-53503
This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the basic auth.ini file. The file contains hard-coded default credentials. An attacker can leverag...
PT-2026-53507
A path traversal vulnerability exists in the extract archive to dir function within the mlflow/pyfunc/dbconnect artifact cache.py file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction...
PT-2026-53499
The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution like overwriting /home//.bashrc. ...
CVE-2026-13484
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
CVE-2026-13484 MLflow Experiment-scoped Label Schema CRUD API authorization
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
CVE-2026-13484
CVE-2026-13484 affects MLflow, specifically the Experiment-scoped Label Schema CRUD API. The vulnerability arises from missing authorization in a function within this API, enabling remote exploitation with high impact to confidentiality, integrity, and availability. Exploitation is described as h...
Authorization Bypass Through User-Controlled Key
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the...
EUVD-2026-39984
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
CVE-2026-13484
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
CVE-2026-13484 MLflow Experiment-scoped Label Schema CRUD API authorization
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
PT-2026-53097
Name of the Vulnerable Software and Affected Versions MLflow versions up to 4666cffc7912ea606d592fc38d6a75e2935f65e7 Description An issue exists within the Experiment-scoped Label Schema CRUD API where a function lacks proper authorization. This allows a remote attacker to perform unauthorized...
CVE-2026-13484: Missing Authorization
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
CVE-2026-54279 vulnerabilities
Vulnerabilities for packages: airflow, open-webui, mlflow...
GHSA-4M7W-QMGQ-4WJ5 vulnerabilities
Vulnerabilities for packages: airflow, open-webui, mlflow...
GHSA-82W8-QH3P-5JFQ vulnerabilities
Vulnerabilities for packages: airflow, semgrep, kserve, mlflow...
GHSA-JP82-JPQV-5VV3 vulnerabilities
Vulnerabilities for packages: airflow, semgrep, kserve, mlflow...
GHSA-4FVR-RGM6-GQMC vulnerabilities
Vulnerabilities for packages: airflow, open-webui, mlflow...
GHSA-63HW-FMQ6-XXG2 vulnerabilities
Vulnerabilities for packages: airflow, open-webui, mlflow...