Advisoriesby Ibis
MLflow security advisories
87 advisories · 25 critical or high in 12 months · latest Oct 27
60 of 87 advisories
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version sourceCVE-2026-116690fixed in 3.17.0MLflow CrewAI autologging records LLM provider API keys in logged trace spansCVE-2026-116691fixed in 3.17.0MLflow: unsafe deserializationCVE-2026-116692fixed in 3.17.0MLflow: server-side request forgeryCVE-2026-115886fixed in 3.17.0MLflow FileStore trace IDs allow path traversal and arbitrary file writesCVE-2026-53995fixed in 3.17.2MLflow: unsafe deserializationGHSA-gqvg-gmmx-x4hmfixed in 3.15.0MLflow: server-side request forgeryCVE-2026-64849fixed in 3.15.0MLflow AI Gateway permits SSRF through an unvalidated api_baseCVE-2026-71211no fix yetMLflow: trace API endpoints lack proper authorization validatorsCVE-2026-8147fixed in 3.13.0rc0MLflow: Deterministic sampling in dataset digest enables predictable collisionsCVE-2026-10803fixed in 3.10.1MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltrationCVE-2026-4035fixed in 3.11.0MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitionsCVE-2026-3198fixed in 3.11.0rc0MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabledCVE-2026-2651fixed in 3.10.0MLflow: information disclosureCVE-2026-2734fixed in 3.10.0MLflow: origin validation errorCVE-2026-2611fixed in 3.10.0MLFlow Creates a Temporary File With Insecure PermissionsCVE-2026-4137fixed in 3.11.0MLflow: unauthenticated access to certain FastAPI routesCVE-2026-2652fixed in 3.11.0MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystemCVE-2026-2614fixed in 3.10.0MLflow Has a Server-Side Request Forgery (SSRF) VulnerabilityCVE-2026-2393fixed in 3.9.0MLflow is vulnerable to an authorization bypass affecting the AJAX endpointCVE-2026-33866fixed in 3.11.0rc0MLflow: cross-site scriptingCVE-2026-33865fixed in 3.11.1MLflow: remote code executionCVE-2026-0545no fix yetMlflow: Command Injection when serving models with enable_mlserver=TrueCVE-2026-0596fixed in 3.9.0MLflow Command Injection vulnerabilityCVE-2025-15379fixed in 3.8.1MLFlow path traversal vulnerabilityCVE-2025-15036fixed in 3.9.0rc0MLFlow allows Tracing + Assessments AccessCVE-2025-15381no fix yetArbitrary file write via tar traversal in mlflowCVE-2025-15031fixed in 3.9.0rc0MLflow has a command injection in mlflow/sagemaker/__init__.pyCVE-2025-14287fixed in 3.8.0rc0MLflow Use of Default Password Authentication Bypass VulnerabilityCVE-2026-2635fixed in 3.8.0rc0MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution VulnerabilityCVE-2026-2033fixed in 3.8.0rc0mlflow Creates of Temporary File in Directory with Insecure PermissionsCVE-2025-10279fixed in 3.4.0rc0MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validationCVE-2025-14279fixed in 3.5.0MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution VulnerabilityCVE-2025-11201fixed in 2.22.4 +1MLflow Weak Password Requirements Authentication Bypass VulnerabilityCVE-2025-11200fixed in 2.22.0rc0MLFlow SSRF via gateway_proxy_handlerCVE-2025-52967fixed in 2.22.2 +1MLflow has Weak Password RequirementsCVE-2025-1474fixed in 2.19.0MLflow Cross-Site Request Forgery (CSRF) vulnerabilityCVE-2025-1473fixed in 2.20.3MLflow Uncontrolled Resource Consumption vulnerabilityCVE-2025-0453no fix yetMLflow has a Local File Read/Path Traversal in dbfsCVE-2024-8859fixed in 2.17.0rc0MLflow Uncontrolled Resource Consumption vulnerabilityCVE-2024-6838no fix yetMLflow's excessive directory permissions allow local privilege escalationCVE-2024-27134fixed in 2.16.0Undefined Behavior in mlflowCVE-2024-3099fixed in 2.11.3Local File Inclusion in mlflowCVE-2024-2928fixed in 2.11.3Remote code execution in mlflowCVE-2024-0520fixed in 2.9.0MLFlow unsafe deserializationCVE-2024-37060no fix yetMLFlow unsafe deserializationCVE-2024-37058no fix yetMLFlow unsafe deserializationCVE-2024-37057no fix yetMLFlow improper input validationCVE-2024-37061no fix yetMLFlow unsafe deserializationCVE-2024-37059no fix yetMLFlow unsafe deserializationCVE-2024-37053no fix yetMLFlow unsafe deserializationCVE-2024-37052no fix yetMLFlow unsafe deserializationCVE-2024-37056no fix yetMLFlow unsafe deserializationCVE-2024-37054no fix yetMLFlow unsafe deserializationCVE-2024-37055no fix yetMLflow allows low privilege users to delete any artifactCVE-2024-4263fixed in 2.10.1MLflow has a Local File Read/Path Traversal bypassCVE-2024-3848fixed in 2.12.1mlflow vulnerable to Path TraversalCVE-2024-3573fixed in 2.10.0mlflow vulnerable to Path TraversalCVE-2024-1560no fix yetmlflow vulnerable to Path TraversalCVE-2024-1593no fix yetmlflow vulnerable to Path TraversalCVE-2024-1558fixed in 2.12.1