MLflow — CVE history (PyPI)

MLflow

86 CVEs affect the MLflow PyPI package (highest CVSS 10.0). 1 on CISA's Known Exploited Vulnerabilities catalog. Latest disclosed: 2026-09-23. Full CVE history sourced from NVD.

Summary

Package: MLflow (PyPI)
Total CVEs: 86
Actively exploited (CISA KEV): 1
Highest CVSS: 10.0
Latest disclosed: 2026-09-23

Recent CVEs (top 20)

CVE	Severity	CVSS	KEV	Published	Summary
`CVE-2026-96804`	High	`8.8`	—	2026-09-23	MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
`CVE-2026-96775`	High	`8.8`	—	2026-09-23	MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
`CVE-2026-79721`	—	—	—	2026-09-08	Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.
`CVE-2026-69148`	High	`7.1`	—	2026-08-17	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
`CVE-2026-69146`	Medium	`6.5`	—	2026-08-17	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
`CVE-2026-64849`	Critical	`9.3`	KEV	2026-08-17	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.
`CVE-2026-71211`	High	`7.1`	—	2026-08-05	MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim.
`CVE-2026-8147`	High	`8.1`	—	2026-07-02	In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators.
`CVE-2026-13484`	Medium	`5.0`	—	2026-06-28	A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7.
`CVE-2026-10803`	Low	`3.6`	—	2026-06-04	A flaw has been found in MLflow up to 3.10.0.
`CVE-2026-4035`	High	`7.7`	—	2026-06-03	A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlle…
`CVE-2026-3198`	Medium	`6.5`	—	2026-06-02	MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints.
`CVE-2026-2651`	Critical	`9.0`	—	2026-05-25	A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled.
`CVE-2026-2734`	Medium	`6.5`	—	2026-05-21	In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model authorization checks when basic authentication is enabled.
`CVE-2026-2611`	Critical	`9.6`	—	2026-05-19	In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.
`CVE-2026-4137`	High	`7.8`	—	2026-05-18	In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` func…
`CVE-2026-2652`	High	`8.6`	—	2026-05-15	A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI).
`CVE-2026-2614`	High	`7.5`	—	2026-05-11	A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem.
`CVE-2026-2393`	High	`7.1`	—	2026-05-11	A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0.
`CVE-2026-33866`	Medium	`4.3`	—	2026-04-07	MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts.

All-time worst (top 10 by CVSS)

CVE	Severity	CVSS	KEV	Published	Summary
`CVE-2025-15379`	Critical	`10.0`	—	2026-03-30	A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function.
`CVE-2025-15036`	Critical	`10.0`	—	2026-03-30	A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository.
`CVE-2023-3765`	Critical	`10.0`	—	2023-07-19	Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
`CVE-2026-0545`	Critical	`9.8`	—	2026-04-03	In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled.
`CVE-2025-11201`	Critical	`9.8`	—	2025-10-29	MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability.
`CVE-2025-11200`	Critical	`9.8`	—	2025-10-29	MLflow Weak Password Requirements Authentication Bypass Vulnerability.
`CVE-2023-6975`	Critical	`9.8`	—	2023-12-20	A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
`CVE-2023-6974`	Critical	`9.8`	—	2023-12-20	A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.
`CVE-2023-6014`	Critical	`9.8`	—	2023-11-16	An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
`CVE-2023-6018`	Critical	`9.8`	—	2023-11-16	An attacker can overwrite any file on the server hosting MLflow without any authentication.

Actively exploited (CISA KEV — 1)

CVE	Severity	CVSS	KEV	Published	Summary
`CVE-2026-64849`	Critical	`9.3`	KEV	2026-08-17	MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.