Vulnerabilidades em mlflow

89 resultados
Análise Vexday

O MLflow acumula 54 CVEs catalogadas, das quais 21 são classificadas como críticas — volume que exige atenção contínua em ambientes de MLOps. Embora nenhuma vulnerabilidade conste atualmente no catálogo KEV da CISA, o que situa a taxa de exploração ativa abaixo da média geral do catálogo, o score EPSS de 0,8972 associado a CVE-2023-6909 indica probabilidade elevada de exploração para essa vulnerabilidade específica, tornando-a prioridade imediata de remediação. A presença de 3 CVEs com PoC pública e 11 falhas surgidas nos últimos 90 dias demonstra uma superfície de ataque em expansão recente. O tipo de falha mais recorrente (CWE-29, relativo a travessia de caminho com elementos de sequência de diretório) sugere fragilidades no tratamento de caminhos de arquivo, padrão que tende a ser explorado em plataformas de experimentação e registro de modelos com acesso a sistemas de arquivos locais ou remotos.

CVE-2023-1176MEDIUMAbsolute Path Traversal in mlflow/mlflowEPSS 0.6%CVE-2026-8147HIGHAuthorization Bypass in mlflow/mlflowEPSS 0.5%CVE-2026-4035HIGHEnvironment Variable Resolution Vulnerability in mlflow/mlflowEPSS 0.5%CVE-2026-79721HIGHCode execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact toEPSS 0.5%CVE-2024-3099MEDIUMDenial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflowEPSS 0.4%CVE-2026-2734MEDIUMAuthorization Bypass in SearchModelVersions in mlflow/mlflowEPSS 0.4%CVE-2026-69146MEDIUMMLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-authEPSS 0.4%CVE-2026-2611CRITICALImproper Origin Validation in mlflow/mlflowEPSS 0.4%CVE-2026-33866MEDIUMAuthorization Bypass in MLflow AJAX EndpointEPSS 0.4%CVE-2026-118623HIGHMLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityEPSS 0.4%CVE-2026-69148HIGHMLflow: CreateModelVersion source validation does not check READ permission on referenced run_idEPSS 0.4%CVE-2025-1474LOWWeak Password Requirements in mlflow/mlflowEPSS 0.4%CVE-2026-118624MEDIUMMLflow Tracking Server Jobs Missing Authorization Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-2651CRITICALMissing Authorization Validation in mlflow/mlflowEPSS 0.3%CVE-2025-15381HIGHUnauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflowEPSS 0.3%CVE-2026-118628HIGHMLflow get-artifacts Server-Side Request Forgery Information Disclosure VulnerabilityEPSS 0.3%CVE-2024-4263MEDIUMImproper Access Control in mlflow/mlflowEPSS 0.3%CVE-2026-71211HIGHmlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy EndpointEPSS 0.3%CVE-2026-2393HIGHServer-Side Request Forgery (SSRF) in mlflow/mlflowEPSS 0.3%CVE-2026-118625MEDIUMMLflow Tracking Server Missing Authorization Privilege Escalation VulnerabilityEPSS 0.3%