1262 matches found
PYSEC-2026-422 MLFlow Path Traversal Vulnerability
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...
PYSEC-2026-417 Remote Code Execution due to Full Controled File Write in mlflow
The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution like overwriting /home//.bashrc. ...
PYSEC-2026-415 MLflow authentication requirement bypass can allow a user to arbitrarily create an account
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement...
PYSEC-2026-420 MLflow allowed arbitrary files to be PUT onto the server
MLflow allowed arbitrary files to be PUT onto the server...
PT-2026-53507
A path traversal vulnerability exists in the extract archive to dir function within the mlflow/pyfunc/dbconnect artifact cache.py file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction...
CVE-2026-13484
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
CVE-2026-13484 MLflow Experiment-scoped Label Schema CRUD API authorization
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
CVE-2026-13484
CVE-2026-13484 affects MLflow, specifically the Experiment-scoped Label Schema CRUD API. The vulnerability arises from missing authorization in a function within this API, enabling remote exploitation with high impact to confidentiality, integrity, and availability. Exploitation is described as h...
EUVD-2026-39984
A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high...
PT-2026-53097
Name of the Vulnerable Software and Affected Versions MLflow versions up to 4666cffc7912ea606d592fc38d6a75e2935f65e7 Description An issue exists within the Experiment-scoped Label Schema CRUD API where a function lacks proper authorization. This allows a remote attacker to perform unauthorized...
GHSA-JP82-JPQV-5VV3 vulnerabilities
Vulnerabilities for packages: semgrep, mlflow, airflow...
CVE-2026-54279 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, airflow...
GHSA-82W8-QH3P-5JFQ vulnerabilities
Vulnerabilities for packages: semgrep, mlflow, airflow...
GHSA-4M7W-QMGQ-4WJ5 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, airflow...
GHSA-63HW-FMQ6-XXG2 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, airflow...
GHSA-4FVR-RGM6-GQMC vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, airflow...
CVE-2026-54273 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, airflow...
GHSA-XCGM-R5H9-7989 vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, airflow...