Login Request a demo
ML
Product
mlflow
by mlflow · last CVE Oct 27, 2026
On CISA KEVExploited in the wild
30
CVEs
1
On KEV
9.8
Max CVSS
5
New 30D
Vulnerabilities30In the news5Timeline
Severity mix
Critical 4High 20Medium 5Low 1
Severity
All severities30Critical4High20Medium5Low1
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add mlflow to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-64849
In wildKEV
9.3
10%
Aug 17
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
Affected: >= 3.3.0, < 3.15.0
CVE-2026-116692
New
9.8
1%
Oct 27
MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
Affected: >= 3.12.0rc0, < 3.17.0
CVE-2025-11200
9.8
1%
Oct 29
MLflow Weak Password Requirements Authentication Bypass Vulnerability
Affected: 2.21.0
CVE-2025-11201
9.8
26%
Oct 29
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
Affected: 2.21.3
Showing 4