CVE-2023-6909

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-30172

A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter...

CVE-2023-2356

Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-1176

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2...

CVE-2023-6014

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment...

CVE-2023-6018

An attacker can overwrite any file on the server hosting MLflow without any authentication...

CVE-2023-6568

A reflected Cross-Site Scripting XSS vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the us...

CVE-2023-3765

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0...

CVE-2023-6015

MLflow allowed arbitrary files to be PUT onto the server...

CVE-2023-6831

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2...

CVE-2023-2780

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1...

CVE-2023-43472

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API...

CVE-2025-47278 vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-volumes-web-app, kubeflow-jupyter-web-app, emissary, mlflow...

GHSA-4GRG-W6V8-C28G vulnerabilities

Vulnerabilities for packages: airflow, kubeflow-volumes-web-app, kubeflow-jupyter-web-app, emissary, mlflow...

GHSA-4GRG-W6V8-C28G vulnerabilities

Vulnerabilities for packages: airflow-core, airflow, kubeflow-volumes-web-app, nemo, mlflow, kubeflow-jupyter-web-app, emissary, pgadmin4...

CVE-2025-47278 vulnerabilities

Vulnerabilities for packages: airflow-core, airflow, kubeflow-volumes-web-app, nemo, mlflow, kubeflow-jupyter-web-app, emissary, pgadmin4...

Exploit for Path Traversal in Lfprojects Mlflow

MLflow CVE-2023-1177 - PoC & Reproduce Repo này chứa mã khai...

BIT-MLFLOW-2025-0453 Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

In mlflow/mlflow version 2.17.2, the /graphql endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repeatedly request all runs from a given experiment. This can tie up all the workers allocated by MLFlow, rendering the application unable to...

BIT-MLFLOW-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of...

Unauthorized Account Access

mlflow is vulnerable to Unauthorized Account Access. The vulnerability is due to improper user account management during the account creation process or lack of a mandatory password requirement, allows accounts to be created without authentication credentials...