Vulnerabilidades em mlflow

89 resultados
Análise Vexday

O MLflow acumula 54 CVEs catalogadas, das quais 21 são classificadas como críticas — volume que exige atenção contínua em ambientes de MLOps. Embora nenhuma vulnerabilidade conste atualmente no catálogo KEV da CISA, o que situa a taxa de exploração ativa abaixo da média geral do catálogo, o score EPSS de 0,8972 associado a CVE-2023-6909 indica probabilidade elevada de exploração para essa vulnerabilidade específica, tornando-a prioridade imediata de remediação. A presença de 3 CVEs com PoC pública e 11 falhas surgidas nos últimos 90 dias demonstra uma superfície de ataque em expansão recente. O tipo de falha mais recorrente (CWE-29, relativo a travessia de caminho com elementos de sequência de diretório) sugere fragilidades no tratamento de caminhos de arquivo, padrão que tende a ser explorado em plataformas de experimentação e registro de modelos com acesso a sistemas de arquivos locais ou remotos.

CVE-2025-15031HIGHPath Traversal Vulnerability in mlflow/mlflowEPSS 0.8%CVE-2024-37060HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously craftEPSS 0.8%CVE-2026-96804HIGHCVE-2026-96804EPSS 0.7%CVE-2024-3573CRITICALLocal File Inclusion (LFI) via Scheme Confusion in mlflow/mlflowEPSS 0.7%CVE-2024-1594HIGHLocal File Read via Path Traversal in mlflow/mlflowEPSS 0.7%CVE-2026-116692CRITICALMLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modulesEPSS 0.7%CVE-2024-37054HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploadEPSS 0.7%CVE-2024-1593HIGHPath Traversal via Parameter Smuggling in mlflow/mlflowEPSS 0.7%CVE-2024-37052HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadEPSS 0.7%CVE-2026-115886MEDIUMMLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpointsEPSS 0.7%CVE-2024-6838MEDIUMUncontrolled Resource Consumption in mlflow/mlflowEPSS 0.7%CVE-2026-96775HIGHMLflow dspy bypasses pickle deserialization controlEPSS 0.6%CVE-2026-53995HIGHMLflow 3.17.1 and prior Path Traversal via Trace ID APIEPSS 0.6%CVE-2024-37059HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploadEPSS 0.6%CVE-2024-37055HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaEPSS 0.6%CVE-2024-37057HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uplEPSS 0.6%CVE-2024-37056HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaEPSS 0.6%CVE-2024-37053HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadEPSS 0.6%CVE-2024-37058HIGHDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploadEPSS 0.6%CVE-2025-15036CRITICALPath Traversal Vulnerability in mlflow/mlflowEPSS 0.6%