Vulnerabilities in mlflow
89 resultsCVE-2023-1176MEDIUMAbsolute Path Traversal in mlflow/mlflowEPSS 0.6%CVE-2026-8147HIGHAuthorization Bypass in mlflow/mlflowEPSS 0.5%CVE-2026-4035HIGHEnvironment Variable Resolution Vulnerability in mlflow/mlflowEPSS 0.5%CVE-2026-79721HIGHCode execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact toEPSS 0.5%CVE-2024-3099MEDIUMDenial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflowEPSS 0.4%CVE-2026-2734MEDIUMAuthorization Bypass in SearchModelVersions in mlflow/mlflowEPSS 0.4%CVE-2026-69146MEDIUMMLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-authEPSS 0.4%CVE-2026-2611CRITICALImproper Origin Validation in mlflow/mlflowEPSS 0.4%CVE-2026-33866MEDIUMAuthorization Bypass in MLflow AJAX EndpointEPSS 0.4%CVE-2026-118623HIGHMLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-69148HIGHMLflow: CreateModelVersion source validation does not check READ permission on referenced run_idEPSS 0.4%CVE-2025-1474LOWWeak Password Requirements in mlflow/mlflowEPSS 0.4%CVE-2026-118624MEDIUMMLflow Tracking Server Jobs Missing Authorization Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-2651CRITICALMissing Authorization Validation in mlflow/mlflowEPSS 0.3%CVE-2025-15381HIGHUnauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflowEPSS 0.3%CVE-2026-118628HIGHMLflow get-artifacts Server-Side Request Forgery Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-4263MEDIUMImproper Access Control in mlflow/mlflowEPSS 0.3%CVE-2026-71211HIGHmlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy EndpointEPSS 0.3%CVE-2026-2393HIGHServer-Side Request Forgery (SSRF) in mlflow/mlflowEPSS 0.3%CVE-2026-118625MEDIUMMLflow Tracking Server Missing Authorization Privilege Escalation VulnerabilityEPSS 0.3%