MLflow — CVE history (PyPI)
MLflow
79 CVEs affect the MLflow PyPI package (highest CVSS 10.0). Latest disclosed: 2026-07-02. Full CVE history sourced from NVD.
Summary
- Package
MLflow(PyPI)- Total CVEs
79- Actively exploited (CISA KEV)
- 0
- Highest CVSS
10.0- Latest disclosed
- 2026-07-02
Recent CVEs (top 20)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2026-8147 | High | 8.1 | — | 2026-07-02 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. |
CVE-2026-13484 | Medium | 5.0 | — | 2026-06-28 | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. |
CVE-2026-10803 | Low | 3.6 | — | 2026-06-04 | A flaw has been found in MLflow up to 3.10.0. |
CVE-2026-4035 | High | 7.7 | — | 2026-06-03 | A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlle… |
CVE-2026-3198 | Medium | 6.5 | — | 2026-06-02 | MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. |
CVE-2026-2651 | Critical | 9.0 | — | 2026-05-25 | A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. |
CVE-2026-2734 | Medium | 6.5 | — | 2026-05-21 | In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model authorization checks when basic authentication is enabled. |
CVE-2026-2611 | Critical | 9.6 | — | 2026-05-19 | In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. |
CVE-2026-4137 | High | 7.8 | — | 2026-05-18 | In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` func… |
CVE-2026-2652 | High | 8.6 | — | 2026-05-15 | A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). |
CVE-2026-2614 | High | 7.5 | — | 2026-05-11 | A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. |
CVE-2026-2393 | High | 7.1 | — | 2026-05-11 | A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. |
CVE-2026-33866 | Medium | 4.3 | — | 2026-04-07 | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. |
CVE-2026-33865 | Medium | 5.4 | — | 2026-04-07 | MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. |
CVE-2026-0545 | Critical | 9.8 | — | 2026-04-03 | In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. |
CVE-2026-0596 | High | 7.8 | — | 2026-03-31 | A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. |
CVE-2025-15379 | Critical | 9.8 | — | 2026-03-30 | A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. |
CVE-2025-15036 | Critical | 10.0 | — | 2026-03-30 | A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. |
CVE-2025-15381 | High | 7.1 | — | 2026-03-27 | In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. |
CVE-2025-15031 | Critical | 9.1 | — | 2026-03-18 | A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. |
All-time worst (top 10 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2025-15036 | Critical | 10.0 | — | 2026-03-30 | A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. |
CVE-2023-3765 | Critical | 10.0 | — | 2023-07-19 | Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. |
CVE-2026-0545 | Critical | 9.8 | — | 2026-04-03 | In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. |
CVE-2025-15379 | Critical | 9.8 | — | 2026-03-30 | A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. |
CVE-2025-11201 | Critical | 9.8 | — | 2025-10-29 | MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. |
CVE-2025-11200 | Critical | 9.8 | — | 2025-10-29 | MLflow Weak Password Requirements Authentication Bypass Vulnerability. |
CVE-2023-6975 | Critical | 9.8 | — | 2023-12-20 | A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information. |
CVE-2023-6974 | Critical | 9.8 | — | 2023-12-20 | A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine. |
CVE-2023-6014 | Critical | 9.8 | — | 2023-11-16 | An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. |
CVE-2023-6018 | Critical | 9.8 | — | 2023-11-16 | An attacker can overwrite any file on the server hosting MLflow without any authentication. |