MLflowGHSA-fh64-r2vc-xvhr
MLflow: cross-site scripting
Medium5.4CVE-2026-33865 · Published Apr 7, 2026 · updated Sep 10, 2026
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. This issue affects MLflow version through 3.10.1
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 3.11.1 | 3.11.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-79
- Also known as
- BIT-mlflow-2026-33865, CVE-2026-33865, PYSEC-2026-93
- nvd.nist.gov/vuln/detail/CVE-2026-33865
- github.com/mlflow/mlflow/pull/21435
- github.com/mlflow/mlflow/commit/aca4dd0ec88a12f7655155c224371280e9b45dda
- afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors
- cert.pl/en/posts/2026/04/CVE-2026-33865
- github.com/mlflow/mlflow
- github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-93.yaml
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 7 | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint Medium4.3Apr 7 | Medium4.3 | 3.11.0rc0 |
| Apr 3 | MLflow: remote code executionCritical9.1Apr 3 | Critical9.1 | No fix yet |
| Mar 31 | Mlflow: Command Injection when serving models with enable_mlserver=TrueCritical9.6Mar 31 | Critical9.6 | 3.9.0 |
| Mar 30 | MLflow Command Injection vulnerabilityCritical10.0Mar 30 | Critical10.0 | 3.8.1 |
| Mar 30 | MLFlow path traversal vulnerabilityCritical9.6Mar 30 | Critical9.6 | 3.9.0rc0 |
| Mar 27 | MLFlow allows Tracing + Assessments AccessHigh8.1Mar 27 | High8.1 | No fix yet |