ML
Product
mlflow
On CISA KEVExploited in the wild
30
CVEs
1
On KEV
9.8
Max CVSS
5
New 30D
Severity mix
Critical 4High 20Medium 5Low 1
Watch
Add mlflow to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-64849 In wildKEV | 9.3 | Aug 17 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) Affected: >= 3.3.0, < 3.15.0 |
| CVE-2026-116692 New | 9.8 | Oct 27 | MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules Affected: >= 3.12.0rc0, < 3.17.0 |
| CVE-2025-11200 | 9.8 | Oct 29 | MLflow Weak Password Requirements Authentication Bypass Vulnerability Affected: 2.21.0 |
| CVE-2025-11201 | 9.8 | Oct 29 | MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability Affected: 2.21.3 |
| CVE-2026-96804 | 8.8 | Sep 23 | No description published yet Affected: 2.1 before 3.15.0 |
| CVE-2026-96775 | 8.8 | Sep 23 | MLflow dspy bypasses pickle deserialization control Affected: 2.0 |
| CVE-2026-13484 | 8.8 | Jun 28 | MLflow Experiment-scoped Label Schema CRUD API authorization Affected: 4666cffc7912ea606d592fc38d6a75e2935f65e7 |
| CVE-2024-37061 | 8.8 | Jun 4 | Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end… Affected: 1.11.0 |
| CVE-2024-37060 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on… Affected: 1.27.0 |
| CVE-2024-37059 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code… Affected: 0.5.0 |
| CVE-2024-37058 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run… Affected: 2.5.0 |
| CVE-2024-37057 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary… Affected: 2.0.0rc0 |
| CVE-2024-37056 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run… Affected: 1.23.0 |
| CVE-2024-37055 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary… Affected: 1.24.0 |
| CVE-2024-37054 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code… Affected: 0.9.0 |
| CVE-2024-37053 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary… Affected: 1.1.0 |
| CVE-2024-37052 | 8.8 | Jun 4 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary… Affected: 1.1.0 |
| CVE-2026-79721 | 8.6 | Sep 8 | Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end… Affected: 0.0.1 |
| CVE-2026-53995 | 8.2 | Oct 19 | MLflow 3.17.1 and prior Path Traversal via Trace ID API Affected: through 3.17.1 |
| CVE-2026-116690 New | 7.5 | Oct 27 | MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source Affected: >= 3.10.0, < 3.17.0 |
| CVE-2026-2635 | 7.3 | Feb 20 | MLflow Use of Default Password Authentication Bypass Vulnerability Affected: 3.4.0 |
| CVE-2026-2033 | 7.3 | Feb 20 | MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability Affected: 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f |
| CVE-2026-69148 | 7.1 | Aug 17 | MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id Affected: < 3.15.0 |
| CVE-2026-71211 | 7.1 | Aug 5 | mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint Affected: through 3.14.0 |
| CVE-2026-116691 New | 6.5 | Oct 27 | MLflow CrewAI autologging records LLM provider API keys in logged trace spans Affected: >= 2.19.0, < 3.17.0 |
| CVE-2026-115886 New | 6.5 | Oct 23 | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints Affected: >= 3.12.0rc0, < 3.17.0 |
| CVE-2026-69146 | 6.5 | Aug 17 | MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth Affected: < 3.15.0 |
| CVE-2026-33865 | 5.4 | Apr 7 | Stored XSS via unsafe YAML parsing in MLflow Affected: through 3.10.1 |
| CVE-2026-33866 | 4.3 | Apr 7 | Authorization Bypass in MLflow AJAX Endpoint Affected: through 3.10.1 |
| CVE-2026-10803 | 3.6 | Jun 4 | MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash Affected: 3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +5 more |
Showing 30