1212 matches found
EUVD-2024-0533
Malicious code in bioql PyPI...
EUVD-2024-1239
Malicious code in bioql PyPI...
PT-2025-40607
Name of the Vulnerable Software and Affected Versions MLflow affected versions not specified Description This issue allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this flaw, which stems from weak password requirement...
MLflow Weak Password Requirements Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can...
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper...
PT-2025-40608
Name of the Vulnerable Software and Affected Versions MLflow Tracking Server affected versions not specified Description The MLflow Tracking Server contains a directory traversal flaw that allows remote attackers to execute arbitrary code on affected systems. Authentication is not required for...
CVE-2025-59420 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui...
GHSA-9GGR-2464-2J32 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui...
BIT-MLFLOW-2025-52967
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
Creation of Temporary File With Insecure Permissions
Overview Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions in the getorcreatetmpdir function in fileutils.py. This enables an attacker who can write to /tmp to cause the execution of arbitrary .py files during environment setup. Remediation...
Creation of Temporary File With Insecure Permissions
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions in the...
Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow
| / || |...
Authorization Bypass in MLflow Basic Auth (unprotected Flask/GraphQL routes)
This report is not public...
BIT-MLFLOW-2025-1473 CSRF in mlflow/mlflow
A Cross-Site Request Forgery CSRF vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user...
BIT-MLFLOW-2024-8859 Path Traversal in mlflow/mlflow
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while...
Server Side Request Forgery (SSRF)
mlflow is vulnerable to missing input validation. The vulnerability is due to missing validation of the gatewaypath parameter in the gatewayproxyhandler function, allowing an attacker to manipulate the request path to access unintended internal endpoints or services...
SSRF in MLflow via user-controlled gateway_path parameter
Description A Server-Side Request Forgery SSRF vulnerability exists in the gatewayproxyhandler function of MLflow. This function accepts a user-controlled gatewaypath parameter and concatenates it directly with a targeturi, allowing an attacker to control the full outbound HTTP request path from...
CVE-2025-52967
gatewayproxyhandler in MLflow before 3.1.0 lacks gatewaypath validation...
Server-side Request Forgery (SSRF)
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation of th...
