CVE-2026-71211 | High | 7.1 | 2026-08-05 | MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation… |
CVE-2026-8147 | High | 8.1 | 2026-07-02 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any aut… |
CVE-2026-4035 | High | 7.7 | 2026-06-03 | A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to e… |
CVE-2026-3198 | Medium | 6.5 | 2026-06-02 | MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFO… |
CVE-2026-2651 | Critical | 9.0 | 2026-05-25 | A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. T… |
CVE-2026-2734 | Medium | 6.5 | 2026-05-21 | In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQL query lack proper per-model auth… |
CVE-2026-2611 | Critical | 9.6 | 2026-05-19 | In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote atta… |
CVE-2026-4137 | High | 7.8 | 2026-05-18 | In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-… |
CVE-2026-2652 | High | 8.6 | 2026-05-15 | A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authenticat… |
CVE-2026-2614 | High | 7.5 | 2026-05-11 | A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated r… |
CVE-2026-2393 | High | 7.1 | 2026-05-11 | A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` ac… |
CVE-2026-33866 | Medium | 4.3 | 2026-04-07 | MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a… |
CVE-2026-33865 | Medium | 5.4 | 2026-04-07 | MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attac… |
CVE-2026-0545 | Critical | 9.8 | 2026-04-03 | In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enab… |
CVE-2026-0596 | High | 7.8 | 2026-03-31 | A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell c… |
CVE-2025-15379 | Critical | 9.8 | 2026-03-30 | A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` fu… |
CVE-2025-15036 | Critical | 10.0 | 2026-03-30 | A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow… |
CVE-2025-15381 | High | 7.1 | 2026-03-27 | In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This… |
CVE-2025-15031 | Critical | 9.1 | 2026-03-18 | A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use o… |
CVE-2025-14287 | High | 8.8 | 2026-03-16 | A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The… |
CVE-2026-2635 | High | 7.3 | 2026-02-20 | MLflow Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installatio… |
CVE-2026-2033 | High | 7.3 | 2026-02-20 | MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-10279 | High | 7.0 | 2026-02-02 | In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This v… |
CVE-2025-14279 | High | 8.1 | 2026-01-12 | MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vul… |
CVE-2025-11201 | Critical | 9.8 | 2025-10-29 | MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-11200 | Critical | 9.8 | 2025-10-29 | MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installa… |
CVE-2025-1474 | Medium | 5.5 | 2025-03-20 | In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as ac… |
CVE-2025-1473 | High | 7.1 | 2025-03-20 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacke… |
CVE-2025-0453 | High | 7.5 | 2025-03-20 | In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repe… |
CVE-2024-8859 | High | 7.5 | 2025-03-20 | A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the f… |
CVE-2024-6838 | Medium | 5.3 | 2025-03-20 | In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due… |
CVE-2024-3099 | Medium | 5.4 | 2024-06-06 | A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to… |
CVE-2024-2928 | High | 7.5 | 2024-06-06 | A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerabilit… |
CVE-2024-0520 | High | 8.8 | 2024-06-06 | A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Comm… |
CVE-2024-37061 | High | 8.8 | 2024-06-04 | Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitra… |
CVE-2024-37060 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execut… |
CVE-2024-37059 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to… |
CVE-2024-37058 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentE… |
CVE-2024-37057 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow mo… |
CVE-2024-37056 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit… |
CVE-2024-37055 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model… |
CVE-2024-37054 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to… |
CVE-2024-37053 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn mod… |
CVE-2024-37052 | High | 8.8 | 2024-06-04 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn mod… |
CVE-2024-4263 | Medium | 5.4 | 2024-05-16 | A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can… |
CVE-2024-3848 | High | 7.5 | 2024-05-16 | A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability ari… |
CVE-2024-3573 | Critical | 9.3 | 2024-04-16 | mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the… |
CVE-2024-1594 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an e… |
CVE-2024-1593 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using t… |
CVE-2024-1560 | High | 8.1 | 2024-04-16 | A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path valid… |
CVE-2024-1558 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflow/mlflow repository, due to improper va… |
CVE-2024-1483 | High | 7.5 | 2024-04-16 | A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP… |
CVE-2023-6977 | High | 7.5 | 2023-12-20 | This vulnerability enables malicious users to read sensitive files on the server. |
CVE-2023-6976 | High | 8.8 | 2023-12-20 | This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process. |
CVE-2023-6975 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information. |
CVE-2023-6974 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execut… |
CVE-2023-6940 | High | 8.8 | 2023-12-19 | with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system. |
CVE-2023-6909 | High | 7.5 | 2023-12-18 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6831 | High | 8.1 | 2023-12-15 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6753 | High | 8.8 | 2023-12-13 | Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6709 | High | 8.8 | 2023-12-12 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6568 | Medium | 6.1 | 2023-12-07 | A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POS… |
CVE-2023-6014 | Critical | 9.8 | 2023-11-16 | An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. |
CVE-2023-6018 | Critical | 9.8 | 2023-11-16 | An attacker can overwrite any file on the server hosting MLflow without any authentication. |
CVE-2023-6015 | High | 7.5 | 2023-11-16 | MLflow allowed arbitrary files to be PUT onto the server. |
CVE-2023-4033 | High | 7.8 | 2023-08-01 | OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0. |
CVE-2023-3765 | Critical | 10.0 | 2023-07-19 | Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. |
CVE-2023-2780 | Critical | 9.8 | 2023-05-17 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. |
CVE-2023-2356 | High | 7.5 | 2023-04-28 | Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1. |
CVE-2023-1177 | Critical | 9.3 | 2023-03-24 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
|
CVE-2023-1176 | Low | 3.3 | 2023-03-24 | Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2. |
CVE-2022-0736 | High | 7.5 | 2022-02-23 | Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1. |