Login Request a demo
ML
Vendor
mlflow
2 products with CVEs on record
57
CVEs
1
On KEV
5
New 30D
Products
ML
mlflow
mlflow
9.8
30 CVEs1 on KEV5 new
ML
mlflow/mlflow
mlflow
10.0
27 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-116692
New
ML
mlflow
mlflow
9.8
1%
Oct 27MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules
CVE-2026-116691
New
ML
mlflow
mlflow
6.5
0%
Oct 27MLflow CrewAI autologging records LLM provider API keys in logged trace spans
CVE-2026-116690
New
ML
mlflow
mlflow
7.5
1%
Oct 27MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source
CVE-2026-115886
New
ML
mlflow
mlflow
6.5
0%
Oct 23MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
CVE-2026-53995
ML
mlflow
mlflow
8.2
1%
Oct 19MLflow 3.17.1 and prior Path Traversal via Trace ID API
CVE-2026-96804
ML
MLflow
MLflow
8.8
1%
Sep 23No description published yet
CVE-2026-96775
ML
MLflow
MLflow
8.8
1%
Sep 23MLflow dspy bypasses pickle deserialization control
CVE-2026-79721
ML
mlflow
mlflow
8.6
0%
Sep 8Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end…
CVE-2026-69146
ML
mlflow
mlflow
6.5
0%
Aug 17MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
CVE-2026-69148
ML
mlflow
mlflow
7.1
0%
Aug 17MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
CVE-2026-64849
In wildKEV
ML
mlflow
mlflow
9.3
10%
Aug 17MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
CVE-2026-71211
ML
mlflow
mlflow
7.1
0%
Aug 5mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
CVE-2026-8147
ML
mlflow/mlflow
mlflow
8.1
1%
Jul 2Authorization Bypass in mlflow/mlflow
CVE-2026-13484
ML
MLflow
Mlflow
8.8
1%
Jun 28MLflow Experiment-scoped Label Schema CRUD API authorization
CVE-2026-10803
ML
MLflow
Mlflow
3.6
0%
Jun 4MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash
CVE-2026-4035
ML
mlflow/mlflow
mlflow
7.7
1%
Jun 3Environment Variable Resolution Vulnerability in mlflow/mlflow
CVE-2026-3198
ML
mlflow/mlflow
mlflow
6.5
0%
Jun 2Improper Access Control in mlflow/mlflow
CVE-2026-2651
ML
mlflow/mlflow
mlflow
9.0
0%
May 25Missing Authorization Validation in mlflow/mlflow
CVE-2026-2734
ML
mlflow/mlflow
mlflow
6.5
0%
May 21Authorization Bypass in SearchModelVersions in mlflow/mlflow
CVE-2026-2611
ML
mlflow/mlflow
mlflow
9.6
0%
May 19Improper Origin Validation in mlflow/mlflow
CVE-2026-4137
ML
mlflow/mlflow
mlflow
7.8
0%
May 18Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow
CVE-2026-2652
ML
mlflow/mlflow
mlflow
8.6
21%
May 15Authentication Bypass in mlflow/mlflow
CVE-2026-2614
ML
mlflow/mlflow
mlflow
7.5
4%
May 11Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
CVE-2026-2393
ML
mlflow/mlflow
mlflow
7.1
0%
May 11Server-Side Request Forgery (SSRF) in mlflow/mlflow
CVE-2026-33866
ML
Mlflow
Mlflow
4.3
0%
Apr 7Authorization Bypass in MLflow AJAX Endpoint
CVE-2026-33865
ML
Mlflow
Mlflow
5.4
0%
Apr 7Stored XSS via unsafe YAML parsing in MLflow
CVE-2026-0545
ML
mlflow/mlflow
mlflow
9.8
4%
Apr 3Missing Authentication for Critical Function in mlflow/mlflow
CVE-2026-0596
ML
mlflow/mlflow
mlflow
7.8
1%
Mar 31Command Injection in mlflow/mlflow
CVE-2025-15379
ML
mlflow/mlflow
mlflow
10.0
2%
Mar 30Command Injection in mlflow/mlflow
CVE-2025-15036
ML
mlflow/mlflow
mlflow
10.0
1%
Mar 30Path Traversal Vulnerability in mlflow/mlflow
CVE-2025-15381
ML
mlflow/mlflow
mlflow
7.1
0%
Mar 27Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
CVE-2025-15031
ML
mlflow/mlflow
mlflow
9.1
1%
Mar 18Path Traversal Vulnerability in mlflow/mlflow
CVE-2025-14287
ML
mlflow/mlflow
mlflow
8.8
1%
Mar 15Command Injection in mlflow/mlflow
CVE-2026-2635
ML
MLflow
MLflow
7.3
1%
Feb 20MLflow Use of Default Password Authentication Bypass Vulnerability
CVE-2026-2033
ML
MLflow
MLflow
7.3
2%
Feb 20MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
CVE-2025-10279
ML
mlflow/mlflow
mlflow
7.0
0%
Feb 2Privilege Escalation in mlflow/mlflow
CVE-2025-14279
ML
mlflow/mlflow
mlflow
8.1
0%
Jan 12DNS Rebinding Vulnerability in mlflow/mlflow
CVE-2025-11200
ML
MLflow
MLflow
9.8
1%
Oct 29MLflow Weak Password Requirements Authentication Bypass Vulnerability
CVE-2025-11201
ML
MLflow
MLflow
9.8
26%
Oct 29MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
CVE-2025-0453
ML
mlflow/mlflow
mlflow
7.5
11%
Mar 20Denial of Service through Batched Queries in GraphQL in mlflow/mlflow
CVE-2025-1474
ML
mlflow/mlflow
mlflow
5.5
0%
Mar 20Weak Password Requirements in mlflow/mlflow
CVE-2025-1473
ML
mlflow/mlflow
mlflow
7.1
0%
Mar 20CSRF in mlflow/mlflow
CVE-2024-8859
ML
mlflow/mlflow
mlflow
7.5
3%
Mar 20Path Traversal in mlflow/mlflow
CVE-2024-6838
ML
mlflow/mlflow
mlflow
5.3
1%
Mar 20Uncontrolled Resource Consumption in mlflow/mlflow
CVE-2024-2928
ML
mlflow/mlflow
mlflow
7.5
22%
Jun 6Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
CVE-2024-0520
ML
mlflow/mlflow
mlflow
8.8
2%
Jun 6Remote Code Execution due to Full Controlled File Write in mlflow/mlflow
CVE-2024-3099
ML
mlflow/mlflow
mlflow
5.4
0%
Jun 6Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow
CVE-2024-37061
ML
MLflow
MLflow
8.8
1%
Jun 4Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end…
CVE-2024-37060
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on…
CVE-2024-37059
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code…
CVE-2024-37058
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run…
CVE-2024-37057
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary…
CVE-2024-37056
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run…
CVE-2024-37055
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary…
CVE-2024-37054
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code…
CVE-2024-37053
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary…
CVE-2024-37052
ML
MLflow
MLflow
8.8
1%
Jun 4Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary…