azureml-evaluate-mlflow (>=0.0.35, <=0.0.36), ddi-fw (>=0.0.9, <=0.0.40) +3 more potentially affected by CVE-2025-15381 via mlflow (2.7.1)

mlflow PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.35, =0.0.9, =0.2.0, =1.7.0, =0.4.5, =0.4.9rc1 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2025-15381 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

azureml-evaluate-mlflow (>=0.0.26, <=0.0.34), graphmb (0.2.6) +5 more potentially affected by CVE-2025-15381 via mlflow (2.6.0)

mlflow PYPI version 2.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.26, =0.0.1.post1, =1.0.1, =1.0.2 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

mlflow-cratedb (2.13.0), mlflowcli (0.0.2) +1 more potentially affected by CVE-2025-15381 via mlflow (2.13.0)

mlflow PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.13.0 - mlflowcli 0.0.2 - model-controller 1.0.0 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

sientia-tracker (>=1.0.2, <=1.0.7) potentially affected by CVE-2025-15381 via mlflow (2.10.1)

mlflow PYPI version 2.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - sientia-tracker =1.0.2, =1.0.7 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

azureml-evaluate-mlflow (>=0.0.46, <=47.0.0), cogflow (>=1.2.0, <=1.2.13) +5 more potentially affected by CVE-2025-15381 via mlflow (2.10.2)

mlflow PYPI version 2.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.46, =1.2.0, =0.0.10, =1.2.7, =1.0.0, =0.1.0, =0.1.1 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

getml-mlflow (>=0.1.1, <=0.1.2), stream-pose-ml (>=0.2.1, <=0.3.1) potentially affected by CVE-2025-15381 via mlflow (2.20.4)

mlflow PYPI version 2.20.4 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - getml-mlflow =0.1.1, =0.2.1, =0.3.1 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

mlflow-cratedb (2.22.4) potentially affected by CVE-2025-15381 via mlflow (2.22.4)

mlflow PYPI version 2.22.4 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - mlflow-cratedb 2.22.4 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

autonomize-model-sdk (>=1.0.6, <=1.1.21), experiment-goodies (>=0.1.1, <=0.1.2) +1 more potentially affected by CVE-2025-15381 via mlflow (2.20.1)

mlflow PYPI version 2.20.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk =1.0.6, =0.1.1, =0.1.2 - terratorch 0.99.8 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

aiops-ml (>=1.0.0, <=1.0.1), architxt (>=0.3.1, <=0.5.2) +49 more potentially affected by CVE-2025-15381 via mlflow (>=3.0.0rc2, <=3.8.1)

mlflow PYPI version =3.0.0rc2, =1.0.0, =0.3.1, =1.1.0b1, =0.0.1, =1.0.17.1, =1.23.0, =0.1.0, =0.1.0, =0.0.1rc1, =2.5.0, =0.2.1, =0.0.1, =0.0.1, =0.8.0, =0.8.1 and more Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

api-python-bet-project (>=0.1.23, <=0.1.28), llm-foundry (>=0.19.0, <=0.21.0) +8 more potentially affected by CVE-2025-15381 via mlflow (2.21.3)

mlflow PYPI version 2.21.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - api-python-bet-project =0.1.23, =0.19.0, =2.1.2, =0.1.11, =0.1.51.5, =1.0.4 - terratorch 1.0.1 - wedata-pre-code 2.0.1 Source cves: CVE-2025-15381...

poly-lithic (>=0.1.7.1, <=1.8.0), sm-data-ml-utils (>=0.1.1, <=0.1.3) potentially affected by CVE-2025-15381 via mlflow (2.22.2)

mlflow PYPI version 2.22.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - poly-lithic =0.1.7.1, =0.1.1, =0.1.3 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-15381 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

triggerflow (0.3.3) potentially affected by CVE-2025-15381 via mlflow (2.21.0)

mlflow PYPI version 2.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - triggerflow 0.3.3 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

api-python-bet-project (>=0.1.9, <=0.1.22), bir-mlflow-export-import (1.2.0) +10 more potentially affected by CVE-2025-15381 via mlflow (2.19.0)

mlflow PYPI version 2.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - api-python-bet-project =0.1.9, =1.1.5, =0.14.0, =0.14.0, =0.14.0, =1.4.4, =1.0.0, =0.1.0a0, =0.3.5, =0.3.9 Source cves: CVE-2025-15381 Source...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-15381 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

azureml-evaluate-mlflow (>=0.0.14, <=0.0.25), graphmb (0.2.5) +1 more potentially affected by CVE-2025-15381 via mlflow (2.3.1)

mlflow PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.14, =1.0.3, =1.2.5 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

PYSEC-2026-2657 MLFlow allows Tracing + Assessments Access

In the latest version of mlflow/mlflow, when the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with NOPERMISSIONS on the experiment, to read trace information and create assessments for...

csc-mlops (>=0.9.21, <=0.10.0), mlflow-cratedb (2.10.0) +1 more potentially affected by CVE-2025-15381 via mlflow (2.10.0)

mlflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.9.21, =0.10.0 - mlflow-cratedb 2.10.0 - refract-mlflow-plugin 1.0.3 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...

azureml-contrib-run (>=1.0.18.2, <=1.0.21.1) potentially affected by CVE-2025-15381 via mlflow (0.8.2)

mlflow PYPI version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-contrib-run =1.0.18.2, =1.0.21.1 Source cves: CVE-2025-15381 Source advisory: OSV:PYSEC-2026-2657...