mlflow
5 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-13484 | 4666cffc7912ea606d592fc38d6a75e2935f65e7 | MLflow Experiment-scoped Label Schema CRUD API authorization | LOW 2.3 | 0.5 % | ||
| CVE-2026-10803 | 3.0 ; 3.1 ; 3.2 ; … | MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash | LOW 2.0 | 0.1 % | ||
| CVE-2024-27134 | < 2.16.0 | Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf | HIGH 7.0 | 0.1 % | ||
| CVE-2024-27133 | ≤ 2.9.2 | Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. | CRITICAL 9.6 | 0.7 % | ||
| CVE-2024-27132 | ≤ 2.9.2 | Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. | CRITICAL 9.6 | 0.9 % |