mlflow
Built from the advisories that name this package: its registry metadata (versions, licence, dependencies) has not been fetched by this service yet.
At a glance
- Ecosystem
- PyPI
- Vulnerability status
- 167 advisory(ies) without a verdict
Advisories (167)
| Advisory | Affected versions | Latest version |
|---|---|---|
| GHSA-26p8-2jq9-3vq9 MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules | 3.12.0rc0 – < 3.17.0 | Undetermined |
| GHSA-2cm6-r77w-6g96 MLflow: trace API endpoints lack proper authorization validators | 2.14.0rc0 – < 3.13.0rc0 | Undetermined |
| GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | 3.12.0rc0 – < 3.17.0 | Undetermined |
| GHSA-3v79-q7ph-j75h MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution | < 2.10.0 | Undetermined |
| GHSA-42h5-h8qh-vv9v MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem | < 3.10.0 | Undetermined |
| GHSA-43c4-9qgj-x742 MLFlow unsafe deserialization | 1.1.0 – 2.14.1 | Undetermined |
| GHSA-46r5-x6jq-v8g6 MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint | < 3.11.0rc0 | Undetermined |
| GHSA-49m6-vrr9-2cqm MLflow Uncontrolled Resource Consumption vulnerability | ≤ 2.17.2 | Undetermined |
| GHSA-4qq5-mxxx-m6gg MLflow authentication requirement bypass can allow a user to arbitrarily create an account | < 2.8.0 | Undetermined |
| GHSA-4rj2-9gcx-5qhx MLflow has Weak Password Requirements | < 2.19.0 | Undetermined |
| GHSA-4rqf-8pfm-p36r MLflow has a Local File Read/Path Traversal in dbfs | < 2.17.0rc0 | Undetermined |
| GHSA-4x5p-f36r-mxxr mlflow Creates of Temporary File in Directory with Insecure Permissions | < 3.4.0rc0 | Undetermined |
| GHSA-554w-xh4j-8w64 Path traversal in MLflow | < 2.9.2 | Undetermined |
| GHSA-59v3-898r-qwhj MLflow Server-Side Request Forgery (SSRF) | < 2.9.2 | Undetermined |
| GHSA-5cvj-7rg6-jggj MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability | 3.0.0rc0 – < 3.0.0 ; < 2.22.4 | Undetermined |
| GHSA-5mvj-wmgj-7q8c mlflow vulnerable to Path Traversal | ≤ 2.9.2 | Undetermined |
| GHSA-5p3h-7fwh-92rc Remote Code Execution due to Full Controled File Write in mlflow | < 2.9.2 | Undetermined |
| GHSA-5q6c-ffvg-xcm9 Remote code execution in mlflow | < 2.9.0 | Undetermined |
| GHSA-5qmp-p3c4-72qj MLflow: Deterministic sampling in dataset digest enables predictable collisions | < 3.10.1 | Undetermined |
| GHSA-5r3q-93q3-f978 MLflow Path Traversal Vulnerability | < 2.9.2 | Undetermined |
| GHSA-65h7-c7c4-mghx MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability | < 3.9.0 | Undetermined |
| GHSA-6749-m5cp-6cg7 Cross-site Scripting in MLFlow | < 2.10.0 | Undetermined |
| GHSA-67c5-x5mf-rppq MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution | 3.9.0 – < 3.10.0 | Undetermined |
| GHSA-6xj8-rrqx-r4cv MLflow Weak Password Requirements Authentication Bypass Vulnerability | < 2.22.0rc0 | Undetermined |
| GHSA-75cm-x2w3-8mgf MLflow: unauthenticated access to certain FastAPI routes | < 3.11.0 | Undetermined |
| GHSA-76cg-cfhx-373f MLFlow unsafe deserialization | 1.1.0 – 2.14.1 | Undetermined |
| GHSA-7gwp-5pfp-969j MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | 3.3.0 – < 3.15.0 | Undetermined |
| GHSA-7p8j-qv6x-f4g4 MLFlow unsafe deserialization | 1.23.0 – 2.14.1 | Undetermined |
| GHSA-7qhf-v65m-g5f3 mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization | ≤ 3.10.1 | Undetermined |
| GHSA-83fm-w79m-64r5 Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs | < 2.3.1 | Undetermined |
| GHSA-8c7q-86fq-vvmh MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled | < 3.10.0 | Undetermined |
| GHSA-8f8q-q2j7-7j2m Undefined Behavior in mlflow | < 2.11.3 | Undetermined |
| GHSA-969w-gqqr-g6j3 MLflow Cross-Site Request Forgery (CSRF) vulnerability | 2.17.0 – < 2.20.3 | Undetermined |
| GHSA-cv6c-7963-wxcg MLFlow unsafe deserialization | 1.27.0 – 2.14.1 | Undetermined |
| GHSA-cwgg-w6mp-w9hg MLFlow unsafe deserialization | 2.5.0 – 2.14.1 | Undetermined |
| GHSA-cxfr-5q3r-2rc2 Jinja2 template injection in mlflow | < 2.9.2 | Undetermined |
| GHSA-f2m9-wcf4-cwwx MLFlow Creates a Temporary File With Insecure Permissions | 1.26.0 – < 3.11.0 | Undetermined |
| GHSA-f42m-mvfv-cgw5 mlflow vulnerable to Path Traversal | ≤ 2.9.2 | Undetermined |
| GHSA-f798-qm4r-23r5 MLflow allowed arbitrary files to be PUT onto the server | < 2.8.1 | Undetermined |
| GHSA-f82r-jj5r-6g97 mlflow Path Traversal vulnerability | < 2.12.1 | Undetermined |
| GHSA-ffw3-6378-cqgp mlflow vulnerable to OS Command Injection | < 2.6.0 | Undetermined |
| GHSA-fh64-r2vc-xvhr MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface | < 3.11.1 | Undetermined |
| GHSA-fhff-qmm8-h2fp Arbitrary file write via tar traversal in mlflow | < 3.9.0rc0 | Undetermined |
| GHSA-fmxj-6h9g-6vw3 MLflow Path Traversal vulnerability | < 2.5.0 | Undetermined |
| GHSA-g35p-px32-whv6 MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration | < 3.11.0 | Undetermined |
| GHSA-g6pg-52vf-843h MLFlow allows Tracing + Assessments Access | ≤ 3.8.1 | Undetermined |
| GHSA-ghv6-9r9j-wh4j MLFlow unsafe deserialization | 0.9.0 – 2.14.1 | Undetermined |
| GHSA-gq3w-7jj3-x7gr MLflow Use of Default Password Authentication Bypass Vulnerability | < 3.8.0rc0 | Undetermined |
| GHSA-gqvg-gmmx-x4hm MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact | 2.1.0 – < 3.15.0 | Undetermined |
| GHSA-h7x2-h6g9-p789 MLflow AI Gateway permits SSRF through an unvalidated api_base | 3.13.0 – 3.15.2 | Undetermined |
| GHSA-hh8p-p8mp-gqhm MLFlow Path Traversal Vulnerability | < 2.9.2 | Undetermined |
| GHSA-hq88-wg7q-gp4g mlflow vulnerable to Path Traversal | < 2.10.0 | Undetermined |
| GHSA-hvc6-42vf-jhf8 mlflow Command Injection vulnerability | < 2.9.2 | Undetermined |
| GHSA-j46q-5pxx-8vmw Local File Inclusion in mlflow | < 2.11.3 | Undetermined |
| GHSA-j62r-wxqq-f3gf mlflow vulnerable to Path Traversal | < 2.12.1 | Undetermined |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | 2.19.0 – < 3.17.0 | Undetermined |
| GHSA-j8mg-pqc5-x9gj MLFlow unsafe deserialization | 2.0.0rc0 – 2.14.1 | Undetermined |
| GHSA-m49c-5c52-6696 mlflow vulnerable to Path Traversal | ≤ 2.9.2 | Undetermined |
| GHSA-m65p-9j7q-6w33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source | 3.10.0 – < 3.17.0 | Undetermined |
| GHSA-p4jx-q62p-x5jr MLflow allows low privilege users to delete any artifact | < 2.10.1 | Undetermined |
| GHSA-pgqp-8h46-6x4j MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation | < 3.5.0 | Undetermined |
| GHSA-pqcv-qw2r-r859 MLFlow improper input validation | 1.11.0 – 2.13.1 | Undetermined |
| GHSA-q2r8-vmq7-fpx2 MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability | < 3.8.0rc0 | Undetermined |
| GHSA-q3gw-8236-5jw4 MLflow Uncontrolled Resource Consumption vulnerability | ≤ 2.13.2 | Undetermined |
| GHSA-qg8p-32gr-gh6x MLflow Local File Disclosure Vulnerability | < 2.9.2 | Undetermined |
| GHSA-qpgc-w4mg-6v92 MLflow's excessive directory permissions allow local privilege escalation | < 2.16.0 | Undetermined |
| GHSA-r23q-823p-vmf7 MLflow Command Injection vulnerability | < 3.8.1 | Undetermined |
| GHSA-r5m9-wm49-959f MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions | < 3.11.0rc0 | Undetermined |
| GHSA-rfqq-wq6w-72jm MLflow has a Local File Read/Path Traversal bypass | 2.9.2 – < 2.12.1 | Undetermined |
| GHSA-rvhj-8chj-8v3c Mlflow: Command Injection when serving models with enable_mlserver=True | < 3.9.0 | Undetermined |
| GHSA-v945-r3rc-6fjm Path traversal in MLflow | < 2.9.2 | Undetermined |
| GHSA-vhcx-3pq2-4fvc MLFlow path traversal vulnerability | < 3.9.0rc0 | Undetermined |
| GHSA-vqj2-4v8m-8vrq Insecure Temporary File in mlflow | < 1.23.1 | Undetermined |
| GHSA-vwhf-3v6x-wff8 Cross-site Scripting (XSS) in MLflow | < 2.9.0 | Undetermined |
| GHSA-w5xq-c4pf-ghq7 MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks | < 3.10.0 | Undetermined |
| GHSA-wc6j-5g83-xfm6 mflow vulnerable to directory traversal | < 2.0.0rc0 | Undetermined |
| GHSA-wf7f-8fxf-xfxc MLFlow unsafe deserialization | 0.5.0 – 3.4.0 | Undetermined |
| GHSA-wjq3-7jxx-whj9 mlflow Path Traversal vulnerability | < 2.3.0 | Undetermined |
| GHSA-wp72-7hj9-5265 Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs | < 2.2.1 | Undetermined |
| GHSA-wqmh-qccw-pqwf MLflow FileStore trace IDs allow path traversal and arbitrary file writes | < 3.17.2 | Undetermined |
| GHSA-wqxf-447m-6f5f Information exposure in MLflow | < 2.9.0 | Undetermined |
| GHSA-wv8q-4f85-2p8p MLflow Path Traversal Vulnerability | < 2.9.2 | Undetermined |
| GHSA-wxj7-3fx5-pp9m MLFlow SSRF via gateway_proxy_handler | 3.0.0rc0 – < 3.1.0 ; < 2.22.2 | Undetermined |
| GHSA-x38x-g6gr-jqff MLFlow unsafe deserialization | 1.24.0 – 2.14.1 | Undetermined |
| GHSA-x422-6qhv-p29g Relative path traversal in mlflow | < 2.3.1 | Undetermined |
| GHSA-xch3-2f9x-wh9f MLflow has a command injection in mlflow/sagemaker/__init__.py | < 3.8.0rc0 | Undetermined |
| GHSA-xg73-94fp-g449 mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs | < 2.2.1 | Undetermined |
| PYSEC-2022-28 Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1. | < 61984e6843d2e59235d82a580c529920cd8f3711 ; < 1.23.1 | Undetermined |
| PYSEC-2023-252 Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. | < 1da75dfcecd4d169e34809ade55748384e8af6c1 ; < 2.9.2 | Undetermined |
| PYSEC-2023-253 Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. | < 1da75dfcecd4d169e34809ade55748384e8af6c1 ; < 2.9.2 | Undetermined |
| PYSEC-2023-260 A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST | < 28ff3f94994941e038f2172c6484b65dc4db6ca1 ; < 2.9.1 | Undetermined |
| PYSEC-2023-28 Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2. | < 63ef72aa4334a6473ce7f889573c92fcae0b3c0d ; < 2.2.2 | Undetermined |
| PYSEC-2023-280 OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0. | < 6dde93758d42455cb90ef324407919ed67668b9b ; < 2.6.0 | Undetermined |
| PYSEC-2023-281 Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2. | < 432b8ccf27fd3a76df4ba79bb1bec62118a85625 ; < 2.9.2 | Undetermined |
| PYSEC-2023-29 Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. | < 7162a50c654792c21f3e4a160eb1a0e6a34f6e6e ; < 2.2.1 | Undetermined |
| PYSEC-2023-308 Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. | < 6dde93758d42455cb90ef324407919ed67668b9b ; < 2.5.0 | Undetermined |
| PYSEC-2023-309 Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2. | < 1c6309f884798fbf56017a3cc808016869ee8de4 ; < 2.9.2 | Undetermined |
| PYSEC-2023-68 Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1. | < f73147496e05c09a8b83d95fb4f1bf86696c6342 ; < 2.3.1 | Undetermined |
| PYSEC-2023-69 Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. | < fae77a525dd908c56d6204a4cef1c1c75b4e9857 ; < 2.3.1 | Undetermined |
| PYSEC-2023-70 A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server v | < 2.0.1 | Undetermined |
| PYSEC-2024-224 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain e | < 2.16.0 | Undetermined |
| PYSEC-2024-239 A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Comma | < 400c226953b4568f4361bc0a0c223511652c2b9d ; < 2.9.0 | Undetermined |
| PYSEC-2024-240 Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. | < 2.10.0 | Undetermined |
| PYSEC-2024-241 Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the re | < 2.10.0 | Undetermined |
| PYSEC-2024-242 A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability | < 96f0b573a73d8eedd6735a2ce26e08859527be07 ; < 2.11.3 | Undetermined |
| PYSEC-2024-243 mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the s | < 438a450714a3ca06285eeea34bdc6cf79d7f6cbc ; < 2.10.0 | Undetermined |
| PYSEC-2024-244 A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability aris | < f8d51e21523238280ebcfdb378612afd7844eca8 ; < 2.12.1 | Undetermined |
| PYSEC-2024-51 A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can | < b43e0e3de5b500554e13dc032ba2083b2d6c94b8 ; < 2.10.1 | Undetermined |
| PYSEC-2025-17 In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as acc | < 149c9e18aa219bc47e86b432e130e467a36f4a17 ; < 2.19.0 | Undetermined |
| PYSEC-2025-52 gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation. | < 39a419b4ec8fd11b59b3e50ab397042a490f2324 ; < 3.1.0 | Undetermined |
| PYSEC-2026-1636 MLFlow unsafe deserialization | 1.1.0 – 2.14.1 | Undetermined |
| PYSEC-2026-1637 MLflow Uncontrolled Resource Consumption vulnerability | ≤ 2.17.2 | Undetermined |
| PYSEC-2026-1638 MLflow has a Local File Read/Path Traversal in dbfs | < 2.17.0rc0 | Undetermined |
| PYSEC-2026-1639 mlflow Creates of Temporary File in Directory with Insecure Permissions | < 3.4.0rc0 | Undetermined |
| PYSEC-2026-1640 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability | < 2.22.4 ; 3.0.0rc0 – < 3.0.0 | Undetermined |
| PYSEC-2026-1641 mlflow vulnerable to Path Traversal | ≤ 2.9.2 | Undetermined |
| PYSEC-2026-1642 MLflow Weak Password Requirements Authentication Bypass Vulnerability | < 2.22.0rc0 | Undetermined |
| PYSEC-2026-1643 MLFlow unsafe deserialization | 1.1.0 – 2.14.1 | Undetermined |
| PYSEC-2026-1644 MLFlow unsafe deserialization | 1.23.0 – 2.14.1 | Undetermined |
| PYSEC-2026-1645 Undefined Behavior in mlflow | < 2.11.3 | Undetermined |
| PYSEC-2026-1646 MLflow Cross-Site Request Forgery (CSRF) vulnerability | 2.17.0 – < 2.20.3 | Undetermined |
| PYSEC-2026-1647 MLFlow unsafe deserialization | 1.27.0 – 2.14.1 | Undetermined |
| PYSEC-2026-1648 MLFlow unsafe deserialization | 2.5.0 – 2.14.1 | Undetermined |
| PYSEC-2026-1649 mlflow vulnerable to Path Traversal | ≤ 2.9.2 | Undetermined |
| PYSEC-2026-1650 mlflow Path Traversal vulnerability | < 2.12.1 | Undetermined |
| PYSEC-2026-1651 MLFlow unsafe deserialization | 0.9.0 – 2.14.1 | Undetermined |
| PYSEC-2026-1652 mlflow Command Injection vulnerability | < 2.9.2 | Undetermined |
| PYSEC-2026-1653 mlflow vulnerable to Path Traversal | < 2.12.1 | Undetermined |
| PYSEC-2026-1654 MLFlow unsafe deserialization | 2.0.0rc0 – 2.14.1 | Undetermined |
| PYSEC-2026-1655 mlflow vulnerable to Path Traversal | ≤ 2.9.2 | Undetermined |
| PYSEC-2026-1656 MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation | < 3.5.0 | Undetermined |
| PYSEC-2026-1657 MLFlow improper input validation | 1.11.0 – 2.13.1 | Undetermined |
| PYSEC-2026-1658 MLflow Uncontrolled Resource Consumption vulnerability | ≤ 2.13.2 | Undetermined |
| PYSEC-2026-1659 MLflow Local File Disclosure Vulnerability | < 2.9.2 | Undetermined |
| PYSEC-2026-1660 MLFlow unsafe deserialization | 0.5.0 – 3.4.0 | Undetermined |
| PYSEC-2026-1661 Information exposure in MLflow | < 2.9.0 | Undetermined |
| PYSEC-2026-1662 MLflow Path Traversal Vulnerability | < 2.9.2 | Undetermined |
| PYSEC-2026-1663 MLFlow unsafe deserialization | 1.24.0 – 2.14.1 | Undetermined |
| PYSEC-2026-195 A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component | < 3.10.1 | Undetermined |
| PYSEC-2026-2219 A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` acc | < 3.9.0 | Undetermined |
| PYSEC-2026-2220 A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. Th | < 3.11.0rc0 | Undetermined |
| PYSEC-2026-2221 A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authenticati | < 3.10.0 | Undetermined |
| PYSEC-2026-2222 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to ex | < 3.11.0 | Undetermined |
| PYSEC-2026-2654 MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem | < 3.10.0 | Undetermined |
| PYSEC-2026-2655 MLFlow Creates a Temporary File With Insecure Permissions | < 3.11.0 | Undetermined |
| PYSEC-2026-2656 Arbitrary file write via tar traversal in mlflow | < 3.9.0rc0 | Undetermined |
| PYSEC-2026-2657 MLFlow allows Tracing + Assessments Access | ≤ 3.8.1 | Undetermined |
| PYSEC-2026-2658 MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability | < 3.8.0rc0 | Undetermined |
| PYSEC-2026-2659 MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions | < 3.11.0rc0 | Undetermined |
| PYSEC-2026-2660 MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks | < 3.10.0 | Undetermined |
| PYSEC-2026-2661 MLflow has a command injection in mlflow/sagemaker/__init__.py | < 3.8.0rc0 | Undetermined |
| PYSEC-2026-3686 MLflow: trace API endpoints lack proper authorization validators | 2.14.0rc0 – < 3.13.0rc0 | Undetermined |
| PYSEC-2026-3687 MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | < 3.15.0 | Undetermined |
| PYSEC-2026-3865 MLflow AI Gateway permits SSRF through an unvalidated api_base | 3.13.0 – 3.15.2 | Undetermined |
| PYSEC-2026-415 MLflow authentication requirement bypass can allow a user to arbitrarily create an account | < 2.8.0 | Undetermined |
| PYSEC-2026-416 MLflow Server-Side Request Forgery (SSRF) | < 2.9.2 | Undetermined |
| PYSEC-2026-417 Remote Code Execution due to Full Controled File Write in mlflow | < 2.9.2 | Undetermined |
| PYSEC-2026-418 MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution | 3.9.0 – < 3.10.0 | Undetermined |
| PYSEC-2026-419 mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization | ≤ 3.10.1 | Undetermined |
| PYSEC-2026-420 MLflow allowed arbitrary files to be PUT onto the server | < 2.8.1 | Undetermined |
| PYSEC-2026-421 MLflow Use of Default Password Authentication Bypass Vulnerability | < 3.8.0rc0 | Undetermined |
| PYSEC-2026-422 MLFlow Path Traversal Vulnerability | < 2.9.2 | Undetermined |
| PYSEC-2026-423 MLflow Command Injection vulnerability | < 3.8.1 | Undetermined |
| PYSEC-2026-424 Mlflow: Command Injection when serving models with enable_mlserver=True | < 3.9.0 | Undetermined |
| PYSEC-2026-425 MLFlow path traversal vulnerability | < 3.9.0rc0 | Undetermined |
| PYSEC-2026-93 MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attack | < 3.11.0rc0 | Undetermined |
| PYSEC-2026-94 MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a | < 3.11.0rc0 | Undetermined |
Sources
| Source | Licence |
|---|