# mlflow (PyPI) vulnerabilities

85 known vulnerabilities (24 critical, 44 high, 14 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 3.18.0 (Nov 3, 2026): no advisory affects it
- Newest unaffected release: 3.18.0 (Nov 3, 2026), the latest release
- Weekly downloads: 5.2M
- Dependents: 693
- Releases: 193 since 0.0.1 (Jun 4, 2018)
- Registry: https://pypi.org/project/mlflow/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-116692: 3.12.0rc0 to 3.16.1 (3.17.0 is outside it)
- CVE-2026-116691: 2.19.0 to 3.16.1 (3.17.0 is outside it)
- CVE-2026-116690: 3.10.0 to 3.16.1 (3.17.0 is outside it)
- CVE-2026-115886: 3.12.0rc0 to 3.16.1 (3.17.0 is outside it)
- CVE-2026-53995: 0.0.1 to 3.17.1 (3.17.2 is outside it)
- CVE-2026-64849: 0.0.1 to 3.14.0 (3.15.0 is outside it)
- CVE-2026-71211: 3.13.0 to 3.15.2 (3.16.0 is outside it)
- CVE-2026-8147: 2.14.0rc0 to 3.12.0 (3.13.0rc0 is outside it)
- CVE-2026-10803: 0.0.1 to 3.10.0 (3.10.1 is outside it)
- CVE-2026-4035: 0.0.1 to 3.11.0rc1 (3.11.0 is outside it)
- CVE-2026-3198: 0.0.1 to 3.10.1 (3.11.0rc0 is outside it)
- CVE-2026-2651: 0.0.1 to 3.10.1 (3.11.0rc0 is outside it)
- CVE-2026-2734: 0.0.1 to 3.10.0rc0 (3.10.0 is outside it)
- CVE-2026-2611: 3.9.0 to 3.10.0rc0 (3.10.0 is outside it)
- CVE-2026-4137: 0.0.1 to 3.11.0rc1 (3.11.0 is outside it)
- CVE-2026-2652: 0.0.1 to 3.11.0rc1 (3.11.0 is outside it)
- CVE-2026-2614: 0.0.1 to 3.10.0rc0 (3.10.0 is outside it)
- CVE-2026-2393: 0.0.1 to 3.9.0rc0 (3.9.0 is outside it)
- CVE-2026-33866: 0.0.1 to 3.10.1 (3.11.0rc0 is outside it)
- CVE-2026-33865: 0.0.1 to 3.11.0 (3.11.1 is outside it)
- CVE-2026-0545: 0.0.1 to 3.10.1 (3.11.0rc0 is outside it)
- CVE-2026-0596: 0.0.1 to 3.9.0rc0 (3.9.0 is outside it)
- CVE-2025-15379: 0.0.1 to 3.8.0 (3.8.1 is outside it)
- CVE-2025-15036: 0.0.1 to 3.8.1 (3.9.0rc0 is outside it)
- CVE-2025-15381: 0.0.1 to 3.8.1 (3.9.0rc0 is outside it)
- CVE-2025-15031: 0.0.1 to 3.8.1 (3.9.0rc0 is outside it)
- CVE-2025-14287: 0.0.1 to 3.7.0 (3.8.0rc0 is outside it)
- CVE-2026-2635: 0.0.1 to 3.7.0 (3.8.0rc0 is outside it)
- CVE-2026-2033: 0.0.1 to 3.7.0 (3.8.0rc0 is outside it)
- CVE-2025-10279: 0.0.1 to 3.3.2 (3.4.0rc0 is outside it)
- CVE-2025-14279: 0.0.1 to 3.5.0rc0 (3.5.0 is outside it)
- CVE-2025-11200: 0.0.1 to 2.21.3 (2.22.0rc0 is outside it)
- CVE-2025-11201: 0.0.1 to 2.22.3 (2.22.4 is outside it); 3.0.0rc0 to 3.0.0rc3 (3.0.0 is outside it)
- CVE-2025-52967: 0.0.1 to 3.1.0rc0 (3.1.0 is outside it)
- CVE-2025-0453: 0.0.1 to 2.17.2 (2.18.0rc0 is outside it)
- CVE-2025-1474: 0.0.1 to 2.19.0rc0 (2.19.0 is outside it)
- CVE-2025-1473: 2.17.0 to 2.20.2 (2.20.3 is outside it)
- CVE-2024-8859: 0.0.1 to 2.16.2 (2.17.0rc0 is outside it)
- CVE-2024-6838: 0.0.1 to 2.13.2 (2.13.3 is outside it)
- CVE-2024-27134: 0.0.1 to 2.15.1 (2.16.0 is outside it)
- CVE-2024-2928: 0.0.1 to 2.11.2 (2.11.3 is outside it)
- CVE-2024-0520: 0.0.1 to 2.8.1 (2.9.0 is outside it)
- CVE-2024-3099: 0.0.1 to 2.11.2 (2.11.3 is outside it)
- CVE-2024-37061: 1.11.0 to 2.13.1 (2.13.2 is outside it)
- CVE-2024-37060: 1.27.0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-37059: 0.5.0 to 3.4.0 (3.5.0rc0 is outside it)
- CVE-2024-37058: 2.5.0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-37057: 2.0.0rc0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-37056: 1.23.0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-37055: 1.24.0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-37054: 0.9.0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-37053: 1.1.0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-37052: 1.1.0 to 2.14.1 (2.14.2.dev0 is outside it)
- CVE-2024-4263: 0.0.1 to 2.10.0 (2.10.1 is outside it)
- CVE-2024-3848: 0.0.1 to 2.12.0 (2.12.1 is outside it)
- CVE-2024-3573: 0.0.1 to 2.9.2 (2.10.0 is outside it)
- CVE-2024-1558: 0.0.1 to 2.12.0 (2.12.1 is outside it)
- CVE-2024-1594: 0.0.1 to 2.9.2 (2.10.0 is outside it)
- CVE-2024-1593: 0.0.1 to 2.9.2 (2.10.0 is outside it)
- CVE-2024-1483: 0.0.1 to 2.12.0 (2.12.1 is outside it)
- CVE-2024-1560: 0.0.1 to 2.9.2 (2.10.0 is outside it)
- CVE-2024-27133: 0.0.1 to 2.9.2 (2.10.0 is outside it)
- CVE-2024-27132: 0.0.1 to 2.9.2 (2.10.0 is outside it)
- CVE-2023-6977: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6976: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6975: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6974: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6940: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6909: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6831: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6753: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6709: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-6568: 0.0.1 to 2.9.0 (2.9.1 is outside it)
- CVE-2023-43472: 0.0.1 to 2.8.1 (2.9.0 is outside it)
- CVE-2023-6014: 0.0.1 to 2.7.1 (2.8.0 is outside it)
- CVE-2023-6015: 0.0.1 to 2.8.0 (2.8.1 is outside it)
- CVE-2023-6018: 0.0.1 to 2.9.1 (2.9.2 is outside it)
- CVE-2023-4033: 0.0.1 to 2.5.0 (2.6.0 is outside it)
- CVE-2023-3765: 0.0.1 to 2.4.2 (2.5.0 is outside it)
- CVE-2023-2780: 0.0.1 to 2.3.0 (2.3.1 is outside it)
- CVE-2023-30172: 0.0.1 to 2.0.0 (2.0.1 is outside it)
- CVE-2023-2356: 0.0.1 to 2.3.0 (2.3.1 is outside it)
- CVE-2023-1177: 0.0.1 to 2.2.0 (2.2.1 is outside it)
- CVE-2023-1176: 0.0.1 to 2.2.1 (2.2.2 is outside it)
- CVE-2022-0736: 0.0.1 to 1.23.0 (1.23.1 is outside it)

## Advisories (85)

### [CVE-2026-116692](https://cve.now/CVE-2026-116692): MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact…

- Severity: Critical 9.8
- Published: Oct 27, 2026
- Affected: from 3.12.0rc0, fixed in 3.17.0.
- Fixed in 3.17.0 (released Oct 7, 2026, 20 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-116691](https://cve.now/CVE-2026-116691): MLflow CrewAI autologging records LLM provider API keys in logged trace spans

- Severity: Medium 6.5
- Published: Oct 27, 2026
- Affected: from 2.19.0, fixed in 3.17.0.
- Fixed in 3.17.0 (released Oct 7, 2026, 20 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-116690](https://cve.now/CVE-2026-116690): MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source

- Severity: High 7.5
- Published: Oct 27, 2026
- Affected: from 3.10.0, fixed in 3.17.0.
- Fixed in 3.17.0 (released Oct 7, 2026, 20 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-115886](https://cve.now/CVE-2026-115886): MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

- Severity: Medium 6.5
- Published: Oct 23, 2026
- Affected: from 3.12.0rc0, fixed in 3.17.0.
- Fixed in 3.17.0 (released Oct 7, 2026, 16 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-53995](https://cve.now/CVE-2026-53995): MLflow 3.17.1 and prior Path Traversal via Trace ID API

- Severity: High 8.8
- Published: Oct 19, 2026
- Affected: fixed in 3.17.2.
- Fixed in 3.17.2 (released Oct 21, 2026, 2 days after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-64849](https://cve.now/CVE-2026-64849): MLflow: Unauthenticated full-read SSRF in webhook delivery: \_validate\_webhook\_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

- Severity: Critical 9.3 · KEV
- Published: Aug 17, 2026
- Affected: from 3.3.0, fixed in 3.15.0; fixed in 3.15.0.
- Fixed in 3.15.0 (released Jul 31, 2026, 17 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-71211](https://cve.now/CVE-2026-71211): mlflow - Unvalidated Gateway Secret api\_base Enables SSRF via Gateway Proxy Endpoint

- Severity: High 7.1
- Published: Aug 5, 2026
- Affected: from 3.13.0, through 3.15.2.
- Fixed in 3.16.0 (released Sep 4, 2026, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-8147](https://cve.now/CVE-2026-8147): Authorization Bypass in mlflow/mlflow

- Severity: High 8.1
- Published: Jul 2, 2026
- Affected: from 2.14.0rc0, fixed in 3.13.0rc0.
- Fixed in 3.13.0rc0 (released May 22, 2026, 41 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-10803](https://cve.now/CVE-2026-10803): MLflow Dataset Digest Computation digest\_utils.py mlflow.data.digest\_utils weak hash

- Severity: Low 2.0
- Published: Jun 4, 2026
- Affected: fixed in 3.10.1.
- Fixed in 3.10.1 (released Mar 5, 2026, 91 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-4035](https://cve.now/CVE-2026-4035): Environment Variable Resolution Vulnerability in mlflow/mlflow

- Severity: Critical 9.1
- Published: Jun 3, 2026
- Affected: fixed in 3.11.0.
- Fixed in 3.11.0 (released Apr 7, 2026, 57 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-3198](https://cve.now/CVE-2026-3198): Improper Access Control in mlflow/mlflow

- Severity: Medium 6.5
- Published: Jun 2, 2026
- Affected: fixed in 3.11.0rc0.
- Fixed in 3.11.0rc0 (released Mar 16, 2026, 78 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2651](https://cve.now/CVE-2026-2651): Missing Authorization Validation in mlflow/mlflow

- Severity: Critical 9.0
- Published: May 25, 2026
- Affected: fixed in 3.11.0rc0; fixed in 3.10.0.
- Fixed in 3.11.0rc0 (released Mar 16, 2026, 70 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2734](https://cve.now/CVE-2026-2734): Authorization Bypass in SearchModelVersions in mlflow/mlflow

- Severity: Medium 6.5
- Published: May 21, 2026
- Affected: fixed in 3.10.0.
- Fixed in 3.10.0 (released Feb 20, 2026, 90 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2611](https://cve.now/CVE-2026-2611): Improper Origin Validation in mlflow/mlflow

- Severity: Critical 9.6
- Published: May 19, 2026
- Affected: from 3.9.0, fixed in 3.10.0.
- Fixed in 3.10.0 (released Feb 20, 2026, 88 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-4137](https://cve.now/CVE-2026-4137): Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow

- Severity: High 7.0
- Published: May 18, 2026
- Affected: fixed in 3.11.0; from 1.26.0, fixed in 3.11.0.
- Fixed in 3.11.0 (released Apr 7, 2026, 41 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2652](https://cve.now/CVE-2026-2652): Authentication Bypass in mlflow/mlflow

- Severity: High 8.6
- Published: May 15, 2026
- Affected: fixed in 3.10.0; fixed in 3.11.0.
- Fixed in 3.11.0 (released Apr 7, 2026, 38 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2614](https://cve.now/CVE-2026-2614): Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow

- Severity: High 7.5
- Published: May 11, 2026
- Affected: fixed in 3.10.0.
- Fixed in 3.10.0 (released Feb 20, 2026, 80 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2393](https://cve.now/CVE-2026-2393): Server-Side Request Forgery (SSRF) in mlflow/mlflow

- Severity: High 7.1
- Published: May 11, 2026
- Affected: fixed in 3.9.0.
- Fixed in 3.9.0 (released Jan 29, 2026, 102 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-33866](https://cve.now/CVE-2026-33866): Authorization Bypass in MLflow AJAX Endpoint

- Severity: Medium 5.3
- Published: Apr 7, 2026
- Affected: fixed in 3.11.0rc0.
- Fixed in 3.11.0rc0 (released Mar 16, 2026, 22 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-33865](https://cve.now/CVE-2026-33865): Stored XSS via unsafe YAML parsing in MLflow

- Severity: Medium 5.1
- Published: Apr 7, 2026
- Affected: fixed in 3.11.1; fixed in 3.11.0rc0.
- Fixed in 3.11.1 (released Apr 7, 2026, the day of disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-0545](https://cve.now/CVE-2026-0545): Missing Authentication for Critical Function in mlflow/mlflow

- Severity: Critical 9.1
- Published: Apr 3, 2026
- Affected: through 3.10.1.
- Fixed in 3.11.0 (released Apr 7, 2026, 4 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-0596](https://cve.now/CVE-2026-0596): Command Injection in mlflow/mlflow

- Severity: Critical 9.6
- Published: Mar 31, 2026
- Affected: fixed in 3.9.0.
- Fixed in 3.9.0 (released Jan 29, 2026, 61 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-15379](https://cve.now/CVE-2025-15379): Command Injection in mlflow/mlflow

- Severity: Critical 10.0
- Published: Mar 30, 2026
- Affected: fixed in 3.8.1.
- Fixed in 3.8.1 (released Dec 26, 2025, 94 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-15036](https://cve.now/CVE-2025-15036): Path Traversal Vulnerability in mlflow/mlflow

- Severity: Critical 9.6
- Published: Mar 30, 2026
- Affected: fixed in 3.9.0rc0.
- Fixed in 3.9.0rc0 (released Jan 16, 2026, 73 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-15381](https://cve.now/CVE-2025-15381): Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow

- Severity: High 8.1
- Published: Mar 27, 2026
- Affected: through 3.8.1.
- Fixed in 3.9.0 (released Jan 29, 2026, 57 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-15031](https://cve.now/CVE-2025-15031): Path Traversal Vulnerability in mlflow/mlflow

- Severity: High 8.1
- Published: Mar 18, 2026
- Affected: fixed in 3.9.0rc0.
- Fixed in 3.9.0rc0 (released Jan 16, 2026, 61 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-14287](https://cve.now/CVE-2025-14287): Command Injection in mlflow/mlflow

- Severity: High 7.5
- Published: Mar 15, 2026
- Affected: fixed in 3.8.0rc0.
- Fixed in 3.8.0rc0 (released Dec 15, 2025, 90 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2635](https://cve.now/CVE-2026-2635): MLflow Use of Default Password Authentication Bypass Vulnerability

- Severity: Critical 9.8
- Published: Feb 20, 2026
- Affected: fixed in 3.8.0rc0.
- Fixed in 3.8.0rc0 (released Dec 15, 2025, 67 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2026-2033](https://cve.now/CVE-2026-2033): MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability

- Severity: High 8.1
- Published: Feb 20, 2026
- Affected: fixed in 3.8.0rc0.
- Fixed in 3.8.0rc0 (released Dec 15, 2025, 67 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-10279](https://cve.now/CVE-2025-10279): Privilege Escalation in mlflow/mlflow

- Severity: High 7.0
- Published: Feb 2, 2026
- Affected: fixed in 3.4.0rc0.
- Fixed in 3.4.0rc0 (released Sep 12, 2025, 143 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-14279](https://cve.now/CVE-2025-14279): DNS Rebinding Vulnerability in mlflow/mlflow

- Severity: High 8.1
- Published: Jan 12, 2026
- Affected: fixed in 3.5.0.
- Fixed in 3.5.0 (released Oct 16, 2025, 88 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-11200](https://cve.now/CVE-2025-11200): MLflow Weak Password Requirements Authentication Bypass Vulnerability

- Severity: High 8.1
- Published: Oct 29, 2025
- Affected: fixed in 2.22.0rc0.
- Fixed in 2.22.0rc0 (released Apr 16, 2025, 196 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-11201](https://cve.now/CVE-2025-11201): MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

- Severity: High 8.1
- Published: Oct 29, 2025
- Affected: fixed in 2.22.4; from 3.0.0rc0, fixed in 3.0.0; from 3.0.0rc0, fixed in 3.0.0; fixed in 2.22.4.
- Fixed in 2.22.4 (released Dec 5, 2025, 37 days after disclosure) and 3.0.0 (released Jun 10, 2025, 141 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-52967](https://cve.now/CVE-2025-52967): gateway\_proxy\_handler in MLflow before 3.1.0 lacks gateway\_path validation.

- Severity: Medium 5.8
- Published: Jun 23, 2025
- Affected: from 3.0.0rc0, fixed in 3.1.0; fixed in 2.22.2; fixed in 3.1.0.
- Fixed in 3.1.0 (released Jun 10, 2025, 13 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-0453](https://cve.now/CVE-2025-0453): Denial of Service through Batched Queries in GraphQL in mlflow/mlflow

- Severity: Medium 5.9
- Published: Mar 20, 2025
- Affected: through 2.17.2.
- Fixed in 2.18.0 (released Nov 18, 2024, 122 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-1474](https://cve.now/CVE-2025-1474): Weak Password Requirements in mlflow/mlflow

- Severity: Low 3.8
- Published: Mar 20, 2025
- Affected: fixed in 2.19.0.
- Fixed in 2.19.0 (released Dec 11, 2024, 99 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2025-1473](https://cve.now/CVE-2025-1473): CSRF in mlflow/mlflow

- Severity: Medium 5.4
- Published: Mar 20, 2025
- Affected: from 2.17.0, fixed in 2.20.3.
- Fixed in 2.20.3 (released Feb 26, 2025, 22 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-8859](https://cve.now/CVE-2024-8859): Path Traversal in mlflow/mlflow

- Severity: High 7.5
- Published: Mar 20, 2025
- Affected: fixed in 2.17.0rc0.
- Fixed in 2.17.0rc0 (released Sep 27, 2024, 174 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-6838](https://cve.now/CVE-2024-6838): Uncontrolled Resource Consumption in mlflow/mlflow

- Severity: Medium 5.3
- Published: Mar 20, 2025
- Affected: through 2.13.2.
- Fixed in 2.13.3 (released Sep 24, 2026, 553 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-27134](https://cve.now/CVE-2024-27134): Excessive directory permissions in MLflow leads to local privilege escalation when using spark\_udf

- Severity: High 7.0
- Published: Nov 25, 2024
- Affected: fixed in 2.16.0; fixed in 2.16.0.
- Fixed in 2.16.0 (released Aug 30, 2024, 87 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-2928](https://cve.now/CVE-2024-2928): Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

- Severity: High 7.5
- Published: Jun 6, 2024
- Affected: fixed in 2.11.3.
- Fixed in 2.11.3 (released Mar 21, 2024, 77 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-0520](https://cve.now/CVE-2024-0520): Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

- Severity: Critical 10.0
- Published: Jun 6, 2024
- Affected: fixed in 2.9.0; fixed in 2.9.0.
- Fixed in 2.9.0 (released Dec 6, 2023, 183 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-3099](https://cve.now/CVE-2024-3099): Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

- Severity: Medium 5.4
- Published: Jun 6, 2024
- Affected: fixed in 2.11.3.
- Fixed in 2.11.3 (released Mar 21, 2024, 77 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37061](https://cve.now/CVE-2024-37061): Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 1.11.0, through 2.13.1.
- Fixed in 2.13.2 (released Jun 6, 2024, 2 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37060](https://cve.now/CVE-2024-37060): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 1.27.0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37059](https://cve.now/CVE-2024-37059): Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 0.5.0, through 3.4.0.
- Fixed in 3.5.0 (released Oct 16, 2025, 499 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37058](https://cve.now/CVE-2024-37058): Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 2.5.0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37057](https://cve.now/CVE-2024-37057): Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 2.0.0rc0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37056](https://cve.now/CVE-2024-37056): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 1.23.0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37055](https://cve.now/CVE-2024-37055): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 1.24.0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37054](https://cve.now/CVE-2024-37054): Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 0.9.0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37053](https://cve.now/CVE-2024-37053): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 1.1.0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-37052](https://cve.now/CVE-2024-37052): Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously…

- Severity: High 8.8
- Published: Jun 4, 2024
- Affected: from 1.1.0, through 2.14.1.
- Fixed in 2.14.2 (released Jul 4, 2024, 30 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-4263](https://cve.now/CVE-2024-4263): Improper Access Control in mlflow/mlflow

- Severity: Medium 5.4
- Published: May 16, 2024
- Affected: fixed in 2.10.1.
- Fixed in 2.10.1 (released Feb 6, 2024, 100 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-3848](https://cve.now/CVE-2024-3848): Path Traversal Bypass in mlflow/mlflow

- Severity: High 7.5
- Published: May 16, 2024
- Affected: fixed in 2.12.1; from 2.9.2, fixed in 2.12.1.
- Fixed in 2.12.1 (released Apr 17, 2024, 29 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-3573](https://cve.now/CVE-2024-3573): Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow

- Severity: Critical 9.3
- Published: Apr 16, 2024
- Affected: fixed in 2.10.0; fixed in 2.10.0.
- Fixed in 2.10.0 (released Jan 26, 2024, 81 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-1558](https://cve.now/CVE-2024-1558): Path Traversal Vulnerability in mlflow/mlflow

- Severity: High 7.5
- Published: Apr 16, 2024
- Affected: fixed in 2.12.1.
- Fixed in 2.12.1 (released Apr 17, 2024, 1 day after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-1594](https://cve.now/CVE-2024-1594): Local File Read via Path Traversal in mlflow/mlflow

- Severity: High 7.5
- Published: Apr 16, 2024
- Affected: through 2.9.2.
- Fixed in 2.10.0 (released Jan 26, 2024, 81 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-1593](https://cve.now/CVE-2024-1593): Path Traversal via Parameter Smuggling in mlflow/mlflow

- Severity: High 7.5
- Published: Apr 16, 2024
- Affected: through 2.9.2.
- Fixed in 2.10.0 (released Jan 26, 2024, 81 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-1483](https://cve.now/CVE-2024-1483): Path Traversal Vulnerability in mlflow/mlflow

- Severity: High 7.5
- Published: Apr 16, 2024
- Affected: fixed in 2.12.1.
- Fixed in 2.12.1 (released Apr 17, 2024, 1 day after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-1560](https://cve.now/CVE-2024-1560): Path Traversal Vulnerability in mlflow/mlflow

- Severity: High 8.1
- Published: Apr 16, 2024
- Affected: through 2.9.2.
- Fixed in 2.10.0 (released Jan 26, 2024, 81 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-27133](https://cve.now/CVE-2024-27133): Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.

- Severity: High 7.5
- Published: Feb 23, 2024
- Affected: through 2.9.2; fixed in 2.10.0.
- Fixed in 2.10.0 (released Jan 26, 2024, 28 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2024-27132](https://cve.now/CVE-2024-27132): Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.

- Severity: High 7.5
- Published: Feb 23, 2024
- Affected: through 2.9.2; fixed in 2.10.0.
- Fixed in 2.10.0 (released Jan 26, 2024, 28 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6977](https://cve.now/CVE-2023-6977): Path Traversal: '\\..\\filename'

- Severity: Critical 10.0
- Published: Dec 20, 2023
- Affected: fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 6 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6976](https://cve.now/CVE-2023-6976): Unrestricted Upload of File with Dangerous Type

- Severity: High 8.8
- Published: Dec 20, 2023
- Affected: fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 6 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6975](https://cve.now/CVE-2023-6975): Path Traversal: '\\..\\filename'

- Severity: Critical 9.8
- Published: Dec 20, 2023
- Affected: fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 6 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6974](https://cve.now/CVE-2023-6974): Server-Side Request Forgery (SSRF)

- Severity: High 8.6
- Published: Dec 20, 2023
- Affected: fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 6 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6940](https://cve.now/CVE-2023-6940): Command Injection

- Severity: Critical 9.0
- Published: Dec 19, 2023
- Affected: fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 5 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6909](https://cve.now/CVE-2023-6909): Path Traversal: '\\..\\filename' in mlflow/mlflow

- Severity: High 7.5
- Published: Dec 18, 2023
- Affected: fixed in 2.9.2; fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 4 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6831](https://cve.now/CVE-2023-6831): Path Traversal: '\\..\\filename' in mlflow/mlflow

- Severity: High 8.1
- Published: Dec 15, 2023
- Affected: fixed in 2.9.2; fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 1 day before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6753](https://cve.now/CVE-2023-6753): Path Traversal in mlflow/mlflow

- Severity: Critical 9.6
- Published: Dec 13, 2023
- Affected: fixed in 2.9.2; fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 1 day after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6709](https://cve.now/CVE-2023-6709): Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow

- Severity: Critical 10.0
- Published: Dec 12, 2023
- Affected: fixed in 2.9.2; fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 2 days after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6568](https://cve.now/CVE-2023-6568): Reflected XSS via Content-Type Header in mlflow/mlflow

- Severity: Medium 6.5
- Published: Dec 7, 2023
- Affected: fixed in 2.9.1; fixed in 2.9.0.
- Fixed in 2.9.1 (released Dec 7, 2023, the day of disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-43472](https://cve.now/CVE-2023-43472): An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.

- Severity: Unrated
- Published: Dec 5, 2023
- Affected: fixed in 2.9.0.
- Fixed in 2.9.0 (released Dec 6, 2023, 1 day after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6014](https://cve.now/CVE-2023-6014): MLflow Authentication Bypass

- Severity: Critical 9.1
- Published: Nov 16, 2023
- Affected: fixed in 2.8.0.
- Fixed in 2.8.0 (released Oct 29, 2023, 18 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6015](https://cve.now/CVE-2023-6015): MLflow Arbitrary File Upload

- Severity: Critical 10.0
- Published: Nov 16, 2023
- Affected: fixed in 2.8.1.
- Fixed in 2.8.1 (released Nov 16, 2023, the day of disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-6018](https://cve.now/CVE-2023-6018): MLflow Arbitrary File Write

- Severity: Critical 10.0
- Published: Nov 16, 2023
- Affected: fixed in 2.9.2.
- Fixed in 2.9.2 (released Dec 14, 2023, 28 days after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-4033](https://cve.now/CVE-2023-4033): OS Command Injection in mlflow/mlflow

- Severity: High 8.8
- Published: Aug 1, 2023
- Affected: fixed in 2.6.0; fixed in 2.6.0.
- Fixed in 2.6.0 (released Aug 15, 2023, 14 days after disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-3765](https://cve.now/CVE-2023-3765): Absolute Path Traversal in mlflow/mlflow

- Severity: Critical 10.0
- Published: Jul 19, 2023
- Affected: fixed in 2.5.0; fixed in 2.5.0.
- Fixed in 2.5.0 (released Jul 17, 2023, 2 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-2780](https://cve.now/CVE-2023-2780): Path Traversal: '\\..\\filename' in mlflow/mlflow

- Severity: Critical 9.8
- Published: May 17, 2023
- Affected: fixed in 2.3.1; fixed in 2.3.0.
- Fixed in 2.3.1 (released Apr 28, 2023, 19 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-30172](https://cve.now/CVE-2023-30172): A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary…

- Severity: High 7.5
- Published: May 11, 2023
- Affected: fixed in 2.0.1; fixed in 2.0.0rc0.
- Fixed in 2.0.1 (released Nov 15, 2022, 177 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-2356](https://cve.now/CVE-2023-2356): Relative Path Traversal in mlflow/mlflow

- Severity: Critical 10.0
- Published: Apr 28, 2023
- Affected: fixed in 2.3.1; fixed in 2.3.1.
- Fixed in 2.3.1 (released Apr 28, 2023, the day of disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-1177](https://cve.now/CVE-2023-1177): Path Traversal: '\\..\\filename' in mlflow/mlflow

- Severity: Critical 9.3
- Published: Mar 24, 2023
- Affected: fixed in 2.2.1.
- Fixed in 2.2.1 (released Mar 2, 2023, 22 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2023-1176](https://cve.now/CVE-2023-1176): Absolute Path Traversal in mlflow/mlflow

- Severity: Medium 5.3
- Published: Mar 24, 2023
- Affected: fixed in 2.2.2; fixed in 2.2.1.
- Fixed in 2.2.2 (released Mar 14, 2023, 10 days before disclosure).
- The latest release, 3.18.0, is not affected.

### [CVE-2022-0736](https://cve.now/CVE-2022-0736): Insecure Temporary File in mlflow/mlflow

- Severity: High 8.2
- Published: Feb 23, 2022
- Affected: fixed in 1.23.1.
- Fixed in 1.23.1 (released Jan 27, 2022, 27 days before disclosure).
- The latest release, 3.18.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/mlflow
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.