deepsleep (1.0.3) potentially affected by CVE-2026-4137 via mlflow (1.5.0)

mlflow PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - deepsleep 1.0.3 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...

gordo-components (>=0.44.0, <=0.46.0) potentially affected by CVE-2026-2734 via mlflow (1.4.0)

mlflow PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - gordo-components =0.44.0, =0.46.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2026-2734 via mlflow (1.7.2)

mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

mlfields (0.0.0), poms (0.0.0) potentially affected by CVE-2026-2734 via mlflow (1.20.1)

mlflow PYPI version 1.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlfields 0.0.0 - poms 0.0.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

iqradre (>=0.1.5, <=0.2.1) potentially affected by CVE-2026-2734 via mlflow (1.20.0)

mlflow PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - iqradre =0.1.5, =0.2.1 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

insurautoml (>=0.2.2.10, <=0.2.3), ntcore (>=0.0.1, <=0.0.3) +2 more potentially affected by CVE-2026-2734 via mlflow (1.21.0)

mlflow PYPI version 1.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - insurautoml =0.2.2.10, =0.0.1, =3.0.0, =2.6.3, =2.6.4 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

f9ml (>=0.1.5, <=0.1.6), outboxml (0.8.1) potentially affected by CVE-2026-2734 via mlflow (2.16.0)

mlflow PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - f9ml =0.1.5, =0.1.6 - outboxml 0.8.1 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

f9ml (>=0.1.5, <=0.1.6), outboxml (0.8.1) potentially affected by CVE-2026-4137 via mlflow (2.16.0)

mlflow PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - f9ml =0.1.5, =0.1.6 - outboxml 0.8.1 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...

MLFlow Creates a Temporary File With Insecure Permissions

In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...

PYSEC-2026-2655 MLFlow Creates a Temporary File With Insecure Permissions

In mlflow/mlflow versions prior to 3.11.0, the getorcreatenfstmpdir function in mlflow/utils/fileutils.py creates temporary directories with world-writable permissions 0o777, and the createmodeldownloadingtmpdir function in mlflow/pyfunc/init.py creates directories with group-writable permissions...

ml-management (>=0.1.0, <=0.4.0), telemed-sk (>=1.1.0, <=1.2.5) +1 more potentially affected by CVE-2026-2734 via mlflow (2.4.0)

mlflow PYPI version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ml-management =0.1.0, =1.1.0, =1.0.0, =1.1.37 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2026-4137 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2026-4137 Source advisory: OSV:PYSEC-2026-2655...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2026-2734 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

In mlflow/mlflow versions up to 3.9.0, the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query lack proper per-model authorization checks when basic authentication is enabled. This allows any authenticated user to enumerate all model versions across all registere...

mlflow-cratedb (2.13.0), mlflowcli (0.0.2) +1 more potentially affected by CVE-2026-2734 via mlflow (2.13.0)

mlflow PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.13.0 - mlflowcli 0.0.2 - model-controller 1.0.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

mlflow-cratedb (2.13.1) potentially affected by CVE-2026-2734 via mlflow (2.13.1)

mlflow PYPI version 2.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.13.1 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

mlflow-cratedb (2.14.0) potentially affected by CVE-2026-2734 via mlflow (2.14.0)

mlflow PYPI version 2.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.14.0 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

mlflow-cratedb (2.14.1), mllibprodest (1.8.6) potentially affected by CVE-2026-2734 via mlflow (2.14.1)

mlflow PYPI version 2.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.14.1 - mllibprodest 1.8.6 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2026-2734 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

autonomize-model-sdk (1.0.4), databricks-genai (>=1.0.8, <=1.0.13) +1 more potentially affected by CVE-2026-2734 via mlflow (2.14.2)

mlflow PYPI version 2.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk 1.0.4 - databricks-genai =1.0.8, =1.0.33, =1.0.37 Source cves: CVE-2026-2734 Source advisory: OSV:PYSEC-2026-2660...