Dop2Mop

Dop2Mop A proof-of-concept OpenGraph collector for BloodHound that maps attack paths from DevOps to MLOps infrastructure. Based on Pipelines of Privilege: Attack Paths from DevOps to MLOps Infrastructure by Brett Hawkins @h4wkst3r. Table of Contents Acknowledgments Overview Supported Platforms...

ansible-gen (0.5.2), auto-white-reimu (0.1.4) +9 more potentially affected by CVE-2024-56326 via jinja2 (2.11.0)

jinja2 PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on jinja2 and may be impacted: - ansible-gen 0.5.2 - auto-white-reimu 0.1.4 - cookiecutter 1.7.1 - mlops-generator =0.1.1, =0.1.0, =0.1.3, =0.0.0.1, =0.0.1 Source cves:...

ansible-gen (0.5.2), auto-white-reimu (0.1.4) +9 more potentially affected by CVE-2024-34064 via jinja2 (2.11.0)

jinja2 PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on jinja2 and may be impacted: - ansible-gen 0.5.2 - auto-white-reimu 0.1.4 - cookiecutter 1.7.1 - mlops-generator =0.1.1, =0.1.0, =0.1.3, =0.0.0.1, =0.0.1 Source cves:...

csc-mlops (>=0.9.21, <=0.10.0), mlflow-cratedb (2.10.0) +1 more potentially affected by CVE-2026-4035 via mlflow (2.10.0)

mlflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.9.21, =0.10.0 - mlflow-cratedb 2.10.0 - refract-mlflow-plugin 1.0.3 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV...

csc-mlops (>=0.8.0, <=0.9.18), email-cleaning-service (>=0.0.1, <=1.0.0) +1 more potentially affected by CVE-2026-4035 via mlflow (2.0.1)

mlflow PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.8.0, =0.0.1, =1.6.1, =1.6.2 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV6...

csc-mlops (>=0.8.0, <=0.9.18), email-cleaning-service (>=0.0.1, <=1.0.0) +1 more potentially affected by CVE-2026-4035 via mlflow (2.0.1)

mlflow PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.8.0, =0.0.1, =1.6.1, =1.6.2 Source cves: CVE-2026-4035 Source advisory: OSV:PYSEC-2026-2222...

csc-mlops (>=0.9.21, <=0.10.0), mlflow-cratedb (2.10.0) +1 more potentially affected by CVE-2026-4035 via mlflow (2.10.0)

mlflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.9.21, =0.10.0 - mlflow-cratedb 2.10.0 - refract-mlflow-plugin 1.0.3 Source cves: CVE-2026-4035 Source advisory: OSV:PYSEC-2026-2222...

CVE-2026-7213

A vulnerability was detected in ef10007 MLOpsMCP 1.0.0. This impacts an unknown function of the file fastmcpserver.py of the component savefile Tool. The manipulation of the argument filename/destination results in path traversal. The attack may be performed from remote. The exploit is now public...

CVE-2026-7213

A vulnerability was detected in ef10007 MLOpsMCP 1.0.0. This impacts an unknown function of the file fastmcpserver.py of the component savefile Tool. The manipulation of the argument filename/destination results in path traversal. The attack may be performed from remote. The exploit is now public...

CVE-2026-7213

A vulnerability was detected in ef10007 MLOpsMCP 1.0.0. This impacts an unknown function of the file fastmcpserver.py of the component savefile Tool. The manipulation of the argument filename/destination results in path traversal. The attack may be performed from remote. The exploit is now public...

CVE-2026-7213

CVE-2026-7213 affects ef10007 MLOps_MCP 1.0.0, specifically the save_file Tool’s fastmcp_server.py. The issue is a path traversal vulnerability triggered by manipulating the filename/destination argument. It can be exploited remotely; public exploit is available. The project was informed via issu...

CVE-2026-7213 ef10007 MLOps_MCP save_file Tool fastmcp_server.py path traversal

A vulnerability was detected in ef10007 MLOpsMCP 1.0.0. This impacts an unknown function of the file fastmcpserver.py of the component savefile Tool. The manipulation of the argument filename/destination results in path traversal. The attack may be performed from remote. The exploit is now public...

EUVD-2026-25966

A vulnerability was detected in ef10007 MLOpsMCP 1.0.0. This impacts an unknown function of the file fastmcpserver.py of the component savefile Tool. The manipulation of the argument filename/destination results in path traversal. The attack may be performed from remote. The exploit is now public...

PT-2026-35586

Name of the Vulnerable Software and Affected Versions ef10007 MLOps MCP version 1.0.0 Description A path traversal issue exists in the save file Tool within the fastmcp server.py file. A remote attacker can manipulate the filename/destination argument to access or overwrite files outside the...

csc-mlops (>=0.9.21, <=0.10.0), mlflow-cratedb (2.10.0) +1 more potentially affected by CVE-2026-33866 via mlflow (2.10.0)

mlflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.9.21, =0.10.0 - mlflow-cratedb 2.10.0 - refract-mlflow-plugin 1.0.3 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8...

biome-text (3.3.0), elemeno-ai-sdk (>=0.0.8, <=0.2.4) +5 more potentially affected by CVE-2026-33866 via mlflow (1.20.2)

mlflow PYPI version 1.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text 3.3.0 - elemeno-ai-sdk =0.0.8, =0.0.1, =0.2.1.2, =0.1.5, =2.5.1a1, =0.0.1, =0.0.48 Source cves: CVE-2026-33866 Source advisory:...

csc-mlops (>=0.8.0, <=0.9.18), email-cleaning-service (>=0.0.1, <=1.0.0) +1 more potentially affected by CVE-2026-33866 via mlflow (2.0.1)

mlflow PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.8.0, =0.0.1, =1.6.1, =1.6.2 Source cves: CVE-2026-33866 Source advisory: OSV:GHSA-46R5-X6JQ-V8G6...

csc-mlops (>=0.9.21, <=0.10.0), mlflow-cratedb (2.10.0) +1 more potentially affected by CVE-2026-33865 via mlflow (2.10.0)

mlflow PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.9.21, =0.10.0 - mlflow-cratedb 2.10.0 - refract-mlflow-plugin 1.0.3 Source cves: CVE-2026-33865 Source advisory: OSV:GHSA-FH64-R2VC-XV...

biome-text (3.3.0), elemeno-ai-sdk (>=0.0.8, <=0.2.4) +5 more potentially affected by CVE-2026-33865 via mlflow (1.20.2)

mlflow PYPI version 1.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - biome-text 3.3.0 - elemeno-ai-sdk =0.0.8, =0.0.1, =0.2.1.2, =0.1.5, =2.5.1a1, =0.0.1, =0.0.48 Source cves: CVE-2026-33865 Source advisory:...

csc-mlops (>=0.8.0, <=0.9.18), email-cleaning-service (>=0.0.1, <=1.0.0) +1 more potentially affected by CVE-2026-33866 via mlflow (2.0.1)

mlflow PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - csc-mlops =0.8.0, =0.0.1, =1.6.1, =1.6.2 Source cves: CVE-2026-33866 Source advisory: OSV:PYSEC-2026-94...