EUVD-2026-60473

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original URL while...

CVE-2026-64849 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original U...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +49 more potentially affected by CVE-2026-64849 via mlflow (>=3.3.0, <=3.14.0)

mlflow PYPI version =3.3.0, =1.0.0, =0.4.0, =0.3.0, =0.1.0, =0.8.0, =0.8.0, =0.5.0.0, =0.5.0, =0.9.6, =0.9.7 and more Source cves: CVE-2026-64849 Source advisory: MEND:CVE-2026-64849...

CVE-2026-64849

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original U...

CVE-2026-64849 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original U...

CVE-2026-64849 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original U...

CVE-2026-64849

MLflow versions before 3.15.0 expose an unauthenticated full-read SSRF: _validate_webhook_url() in mlflow/utils/validation.py validates only the original URL while mlflow/webhooks/delivery.py follows HTTP redirects without IP pinning, letting attackers reach internal/cloud-metadata endpoints. CIR...

PT-2026-76825

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0 Description Authenticated users can bypass experiment-level READ permissions to access arbitrary files from another user's artifact directory. The issue occurs because the validate source run and validate source...

CVE-2026-64849: Server-Side Request Forgery (SSRF)

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/id/test endpoint calls validatewebhookurl in mlflow/utils/validation.py only for the original U...

CVE-2026-69148: Missing Authorization

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a runid or modelid after validatesourcerun or validatesourcemodel in mlflow/server/handlers.py verifies only path containment, allowing...

CVE-2026-69146: Missing Authorization

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFOREREQUESTHANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs...

PT-2026-76824

Name of the Vulnerable Software and Affected Versions MLflow versions 3.13.0 through 3.14.x Description When deployed with the built-in basic-auth plugin, an authenticated user can inject arbitrary dataset records into another user's run. This occurs because the LogInputs proto handler is missing...

VulnCheck KEV: CVE-2026-2652

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...

Server-side Request Forgery (SSRF)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +72 more potentially affected by CVE-2026-71211 via mlflow (>=3.0.0rc2, <=3.12.0)

mlflow PYPI version =3.0.0rc2, =1.0.0, =0.3.1, =1.1.0b1, =0.0.1, =1.0.17.1, =1.23.0, =0.3.0, =0.1.0, =0.1.0, =0.0.1rc1, =0.0.1 and more Source cves: CVE-2026-71211 Source advisory: SNYK:PYTHON-MLFLOW-18533511...

azureml-acft-image-components (>=0.0.7, <=0.0.45), azureml-evaluate-mlflow (>=0.0.0, <=0.0.91) +8 more potentially affected by CVE-2026-71211 via mlflow (>=3.14.0, <=3.15.2)

mlflow PYPI version =3.14.0, =0.0.7, =0.0.0, =0.9.1, =0.6.0, =0.2.9, =1.4.0, =1.0.9, =1.0.7, =1.0.12 Source cves: CVE-2026-71211 Source advisory: GHSA-H7X2-H6G9-P789...

MLflow AI Gateway permits SSRF through an unvalidated api_base

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

GHSA-H7X2-H6G9-P789 MLflow AI Gateway permits SSRF through an unvalidated api_base

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

azureml-acft-image-components (>=0.0.7, <=0.0.45), azureml-evaluate-mlflow (>=0.0.0, <=0.0.91) +8 more potentially affected by CVE-2026-71211 via mlflow (>=3.14.0, <=3.15.2)

mlflow PYPI version =3.14.0, =0.0.7, =0.0.0, =0.9.1, =0.6.0, =0.2.9, =1.4.0, =1.0.9, =1.0.7, =1.0.12 Source cves: CVE-2026-71211 Source advisory: OSV:GHSA-H7X2-H6G9-P789...

CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...