1314 matches found
VulnCheck KEV: CVE-2026-2652
A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled --app-name basic-auth and served via uvicorn ASGI. The FastAPI permission middleware only enforces authentication on /gateway/...
Server-side Request Forgery (SSRF)
Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...
GHSA-H7X2-H6G9-P789 MLflow AI Gateway permits SSRF through an unvalidated api_base
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
MLflow AI Gateway permits SSRF through an unvalidated api_base
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
CVE-2026-71211
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
EUVD-2026-53208
MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...
CVE-2026-47487
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...
EUVD-2026-52799
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...
CVE-2026-47487
NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of...
CVE-2026-47487
NVIDIA Triton Inference Server for Linux (versions 0.0–26.02) is affected by a path traversal vulnerability (CWE-22) in the Triton MLflow plugin . An authenticated local user can supply a crafted path in the model name to read, write, or modify files outside the model repository, potentially lead...
CLSA-2026-1783904618 TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 2.22.4.post6+tuxcare...
CLSA-2026-1780879898 TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 2.22.4.post4+tuxcare...
CLSA-2026-1780879893 TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 2.22.4.post3+tuxcare...
CLSA-2026-1775694718 TuxCare security update for 2 packages (4 CVEs)
TuxCare rebuilt 2 packages to address 4 CVEs. Fixed in 2.22.4.post2+tuxcare...
CLSA-2026-1770768731 TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 2.22.4.post1+tuxcare...
CVE-2026-59200 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-45HQ-CXWH-F6VC vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...
GHSA-4X4J-2G7C-83W6 vulnerabilities
Vulnerabilities for packages: mlflow, open-webui, superset...