MLflow vulnerabilities
89 CVEs and advisories name MLflow as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-0545Missing Authentication for Critical Function in mlflow/mlflow
- CVE-2026-0596Command Injection in mlflow/mlflow
- CVE-2025-15379Command Injection in mlflow/mlflow
- CVE-2025-15036Path Traversal Vulnerability in mlflow/mlflow
- CVE-2025-15381Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow
- CVE-2025-15031Path Traversal Vulnerability in mlflow/mlflow
- CVE-2025-14287Command Injection in mlflow/mlflow
- CVE-2026-2635MLflow Use of Default Password Authentication Bypass Vulnerability
- CVE-2026-2033MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
- CVE-2025-10279Privilege Escalation in mlflow/mlflow
- CVE-2025-14279DNS Rebinding Vulnerability in mlflow/mlflow
- CVE-2025-11200MLflow Weak Password Requirements Authentication Bypass Vulnerability
- CVE-2025-11201MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
- CVE-2025-0453Denial of Service through Batched Queries in GraphQL in mlflow/mlflow
- CVE-2025-1474Weak Password Requirements in mlflow/mlflow
- CVE-2025-1473CSRF in mlflow/mlflow
- CVE-2024-8859Path Traversal in mlflow/mlflow
- CVE-2024-6838Uncontrolled Resource Consumption in mlflow/mlflow
- CVE-2024-2928Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
- CVE-2024-0520Remote Code Execution due to Full Controlled File Write in mlflow/mlflow
- CVE-2024-3099Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow
- CVE-2024-37061Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject
- CVE-2024-37060Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously craft
- CVE-2024-37059Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously upload
- CVE-2024-37058Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously upload
- CVE-2024-37057Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously upl
- CVE-2024-37056Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploa
- CVE-2024-37055Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploa
- CVE-2024-37054Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously upload
- CVE-2024-37053Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously upload