Azure Databricks Elevation of Privilege Vulnerability

Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network...

PT-2025-34292 · Microsoft · Azure Databricks

Name of the Vulnerable Software and Affected Versions: Azure Databricks affected versions not specified Description: Improper access control in Azure Databricks can allow an unauthorized attacker to elevate privileges over a network. Recommendations: At the moment, there is no information about a...

Microsoft Azure Databricks Access Control Vulnerability

Microsoft Azure Databricks is an open analytics platform from Microsoft Corporation, USA. An access control error vulnerability exists in Microsoft Azure Databricks that stems from improper access control and could lead to elevation of privilege...

CVE-2025-53763: Improper Access Control

Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network...

GHSA-J5PM-7495-QMR3 vulnerabilities

Vulnerabilities for packages: kbld, metallb, sigstore-scaffolding-fips, cluster-api-azure-controller, postgres-operator-fips, rancher-webhook-fips, fuse-overlayfs-snapshotter, databricks-cli-fips, fluxcd-kustomize-mutating-webhook, glow, qemu-guesthelper, dapr,...

databricks-agents (>=1.0.0rc0, <=1.0.0rc1), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.0.0rc3)

mlflow PYPI version =3.0.0rc2, =1.0.0rc0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: SNYK:PYTHON-MLFLOW-10494137...

databricks-agents (>=0.1.0, <=1.0.0rc3), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.1.0rc0)

mlflow PYPI version =3.0.0rc2, =0.1.0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: GHSA-WXJ7-3FX5-PP9M...

databricks-agents (>=0.1.0, <=1.0.0rc3), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.1.0rc0)

mlflow PYPI version =3.0.0rc2, =0.1.0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: OSV:GHSA-WXJ7-3FX5-PP9M...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2025-52967 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (>=1.2.0a0, <=1.2.0a6), deeptrees (>=1.6.0, <=1.8.2) +1 more potentially affected by CVE-2025-52967 via mlflow (2.18.0)

mlflow PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.2.0a0, =1.6.0, =0.15.1, =0.18.0 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-session (0.1.11) potentially affected by CVE-2025-52967 via mlflow (2.3.0)

mlflow PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session 0.1.11 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-agents (>=0.1.0, <=1.0.0rc3), datamint (>=2.5.0, <=2.5.2) +2 more potentially affected by CVE-2025-52967 via mlflow (>=3.0.0rc2, <=3.1.0rc0)

mlflow PYPI version =3.0.0rc2, =0.1.0, =2.5.0, =0.6.7, =0.8.1 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (>=1.1.8, <=1.2.0a22), sports-prediction-framework (>=0.1.0, <=0.1.4) potentially affected by CVE-2025-52967 via mlflow (2.20.2)

mlflow PYPI version 2.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.8, =0.1.0, =0.1.4 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2025-52967 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

autonomize-model-sdk (1.0.4), databricks-genai (>=1.0.8, <=1.0.13) +1 more potentially affected by CVE-2025-52967 via mlflow (2.14.2)

mlflow PYPI version 2.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - autonomize-model-sdk 1.0.4 - databricks-genai =1.0.8, =1.0.33, =1.0.37 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-session (>=0.0.1, <=0.1.8), geochemistrypi (>=0.7.0, <=0.8.2) +1 more potentially affected by CVE-2025-52967 via mlflow (2.4.1)

mlflow PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-session =0.0.1, =0.7.0, =0.3.0, =0.3.3 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

databricks-genai (1.0.7) potentially affected by CVE-2025-52967 via mlflow (2.11.0)

mlflow PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai 1.0.7 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

azureml-evaluate-mlflow (>=0.0.46, <=47.0.0), cogflow (>=1.2.0, <=1.2.13) +5 more potentially affected by CVE-2025-52967 via mlflow (2.10.2)

mlflow PYPI version 2.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.46, =1.2.0, =0.0.10, =1.2.7, =1.0.0, =0.1.0, =0.1.1 Source cves: CVE-2025-52967 Source advisory: OSV:PYSEC-2025-52...

CVE-2024-49194

Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution RCE by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentially exploit this vulnerability to achiev...

autonomize-ml-observability (>=1.1.0b1, <=1.2.7), autonomize-observer (>=0.0.1, <=0.0.5) +5 more potentially affected by CVE-2025-0453 via mlflow (>=3.0.0rc2, <=3.1.0)

mlflow PYPI version =3.0.0rc2, =1.1.0b1, =0.0.1, =0.1.0, =2.5.0, =0.6.7, =0.0.4, =0.0.9b0 Source cves: CVE-2025-0453 Source advisory: SNYK:PYTHON-MLFLOW-9510841...