CVE-2026-69148 | High | 7.1 | — | 2026-08-17 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. |
CVE-2026-69146 | Medium | 6.5 | — | 2026-08-17 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. |
CVE-2026-64849 | Critical | 9.3 | KEV | 2026-08-17 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. |
CVE-2026-71211 | High | 7.1 | — | 2026-08-05 | MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. |
CVE-2026-8147 | High | 8.1 | — | 2026-07-02 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. |
CVE-2026-13484 | Medium | 5.0 | — | 2026-06-28 | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. |
CVE-2026-10803 | Low | 3.6 | — | 2026-06-04 | A flaw has been found in MLflow up to 3.10.0. |
CVE-2026-4035 | High | 7.7 | — | 2026-06-03 | A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlle… |
CVE-2026-3198 | Medium | 6.5 | — | 2026-06-02 | MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. |
CVE-2026-2651 | Critical | 9.0 | — | 2026-05-25 | A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. |
CVE-2026-2734 | Medium | 6.5 | — | 2026-05-21 | In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model authorization checks when basic authentication is enabled. |
CVE-2026-2611 | Critical | 9.6 | — | 2026-05-19 | In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. |
CVE-2026-4137 | High | 7.8 | — | 2026-05-18 | In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_create_model_downloading_tmp_dir()` func… |
CVE-2026-2652 | High | 8.6 | — | 2026-05-15 | A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). |
CVE-2026-2614 | High | 7.5 | — | 2026-05-11 | A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. |
CVE-2026-2393 | High | 7.1 | — | 2026-05-11 | A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. |
CVE-2026-33866 | Medium | 4.3 | — | 2026-04-07 | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. |
CVE-2026-33865 | Medium | 5.4 | — | 2026-04-07 | MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. |
CVE-2026-0545 | Critical | 9.8 | — | 2026-04-03 | In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. |
CVE-2026-0596 | High | 7.8 | — | 2026-03-31 | A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. |