76 matches found
CVE-2024-37056
CVE-2024-37056 affects the MLflow platform (versions 1.23.0 and newer) and involves unsafe deserialization of untrusted data. According to the sources, uploading a LightGBM scikit-learn model can be deserialized when run or loaded, enabling arbitrary code execution on the end user’s system. The p...
CVE-2026-2652
Summary (CVE-2026-2652) : In mlflow/mlflow
CVE-2026-2651
MLflow CVE-2026-2651 describes missing authorization validation for MPU endpoints under /mlflow-artifacts/mpu/* when serve-artifacts is enabled. Vulnerable in MLflow versions
CVE-2024-37058
CVE-2024-37058 describes a deserialization of untrusted data in MLflow platforms running version 2.5.0 or newer, allowing a maliciously uploaded Langchain AgentExecutor model to execute arbitrary code on an end user’s system during interaction. The connected documents corroborate this issue acros...
CVE-2025-15036
CVE-2025-15036 concerns a path-traversal vulnerability in the mlflow/mlflow project, specifically in mlflow/pyfunc/dbconnect_artifact_cache.py within extract_archive_to_dir(). The issue arises from unvalidated tar member paths during extraction, allowing a tar.gz controlled by an attacker to over...
CVE-2026-10803
MLflow up to 3.10.0 contains a flaw in mlflow.data.digest_utils (Digest Computation) where manipulation leads to use of a weak hash. This affects the Digest Utils function in the Dataset Digest Computation component and enables a local attack. The reported exploitability is high in complexity wit...
CVE-2026-2734
Summary : For mlflow/mlflow up to version 3.9.0, the REST endpoint GET /api/2.0/mlflow/model-versions/search and the GraphQL query mlflowSearchModelVersions lack per-model authorization when basic auth is enabled. This results in any authenticated user being able to enumerate all model versions a...
CVE-2025-14287
Summary: CVE-2025-14287 is a command-injection in mlflow/mlflow prior to v3.7.0. The flaw resides in mlflow/sagemaker/init .py (lines 161–167) where user-supplied container image names are directly interpolated into shell commands and executed with os.system(), enabling arbitrary command executio...
CVE-2024-37057
MLflow vulnerability CVE-2024-37057 affects MLflow platform versions 2.0.0rc0 and later, where deserialization of untrusted data can occur during interaction with a maliciously uploaded TensorFlow model, allowing arbitrary code execution on an end user’s system. The issue is tied to how MLflow lo...
CVE-2024-37053
CVE-2024-37053 applies to MLflow platforms 1.1.0 and newer, where deserialization of untrusted data (a maliciously uploaded scikit-learn model) can cause arbitrary code execution when interacted with. Affected component is the MLflow model loading path (e.g., _load_model_from_local_file). Root ca...
CVE-2024-37060
The CVE-2024-37060 entry corresponds to a deserialization of untrusted data in MLflow 1.27.0 and newer, allowing a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. The root cause is described as unsafe pickle deserialization in the Recipe handling path (recip...
CVE-2026-0545
In mlflow/mlflow, the FastAPI endpoints under /ajax-api/3.0/jobs/* are unprotected when the basic-auth app is enabled. If job execution is enabled (MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without cr...
CVE-2026-2611
Vulnerability summary (CVE-2026-2611) : In MLflow 3.9.0, the MLflow Assistant’s /ajax-api endpoints had improper origin validation, allowing remote attackers to bypass the loopback-only restriction via cross-origin requests from malicious pages. This could let an attacker interact with the MLflow...
CVE-2024-37055
CVE-2024-37055 involves the MLflow platform (v1.24.0+). The issue is a deserialization of untrusted data in the pmdarima model handling, specifically in the _load_model path of mlflow's pmdarima/init .py, which can allow code execution on an end user’s system when a malicious PyFunc model is inte...
CVE-2026-13484
CVE-2026-13484 affects MLflow, specifically the Experiment-scoped Label Schema CRUD API. The vulnerability arises from missing authorization in a function within this API, enabling remote exploitation with high impact to confidentiality, integrity, and availability. Exploitation is described as h...
CVE-2026-3198
MLflow 3.9.0 with basic-auth fails authorization for multiple Gateway API 'list' endpoints. The BEFORE_REQUEST_HANDLERS dictionary in mlflow/server/auth/init .py lacks entries for ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions, allowing any authenticated user to enu...
CVE-2026-4137
CVE-2026-4137 : In mlflow/mlflow before 3.11.0, two temp-dir creation paths expose world/group-writable permissions: get_or_create_nfs_tmp_dir() creates 0o777 and _create_model_downloading_tmp_dir() creates 0o770. This enables local attackers with access to shared NFS mounts (e.g., Databricks) to...
CVE-2026-2393
CVE-2026-2393: MLflow prior to 3.9.0 is vulnerable to SSRF via a user-controlled webhook URL. The _create_webhook() handler stores the URL without validation, and _send_webhook_request() POSTs to that URL, enabling an authenticated attacker to cause the MLflow backend to reach internal services, ...
CVE-2026-8147
CVE-2026-8147 – MLflow trace API authorization bypass : In MLflow versions prior to 3.14.0 running with authentication enabled, the trace API endpoints lack proper authorization validators because the _before_request handler does not register validators for trace endpoints. This allows any authen...
CVE-2025-11200
CVE-2025-11200 corresponds to a MLflow weakness where weak password requirements allow remote authentication bypass. The connected IBM bulletin and OSV/NVD listings confirm the vulnerability in MLflow with a “Weak Password Requirements” description, citing ZDI-CAN-26916 as the related disclosure ...
CVE-2025-15381
Affected software: mlflow/mlflow (deployments using mlflow server --app-name=basic-auth). Vulnerability: When the basic-auth app is enabled, tracing and assessment endpoints are not protected by permission validators, allowing any authenticated user (including those with NO_PERMISSIONS on the exp...
CVE-2025-15031
MLflow is affected by a path-traversal in its pyfunc extraction: tarfile.extractall is used without validating archive paths, allowing crafted tar.gz files to escape the extraction directory via .. or absolute paths. Documents consistently describe potential arbitrary file writes and the risk of ...
CVE-2025-10279
CVE-2025-10279 affects mlflow 2.20.3 where the temporary directory used to create Python virtual environments is created with world-writable permissions (0o777). This insecure permission setup enables a local attacker with write access to /tmp to race and overwrite .py files inside the venv, enab...
CVE-2026-2614
Summary: CVE-2026-2614 affects mlflow/mlflow
CVE-2026-33866
CVE-2026-33866 affects MLflow up to version 3.10.1 and describes an authorization bypass in the AJAX endpoint for downloading saved model artifacts. Due to missing access-control validation, a user without permissions to a given experiment can directly query the endpoint and retrieve artifacts th...