1285 matches found
VulnCheck KEV: CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...
Server-side Request Forgery (SSRF)
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...
CVE-2026-71211
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
EUVD-2026-53208
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
CVE-2026-47487
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...
EUVD-2026-52799
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...
CVE-2026-47487
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...
CVE-2026-47487
NVIDIA Triton Inference Server for Linux (versions 0.0–26.02) is affected by a path traversal vulnerability (CWE-22) in the Triton MLflow plugin . An authenticated local user can supply a crafted path in the model name to read, write, or modify files outside the model repository, potentially lead...
GHSA-45HQ-CXWH-F6VC vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-FJR4-X663-MWXC vulnerabilities
Vulnerabilities for packages: mlflow...
GHSA-XJ96-63GP-2GMR vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-4X4J-2G7C-83W6 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-8V84-F9PQ-WR9X vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-94P4-4CQ8-9G67 vulnerabilities
Vulnerabilities for packages: mlflow...
CVE-2026-59200 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
CVE-2026-59204 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-5X94-69RX-G8H2 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-R9MR-M37C-5FR3 vulnerabilities
Vulnerabilities for packages: mlflow...