Lfprojects Mlflow vulnerabilities

CVE-2023-6974 [CRITICAL] CWE-918 CVE-2023-6974: A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.

CVE-2026-13484 [HIGH] CWE-862 CVE-2026-13484: A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacte A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization. It is possible to launch the attack remotely. A high complexity level is associated with this attack. The exploi

CVE-2026-2611 [CRITICAL] CWE-346 CVE-2026-2611: In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its / In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attack

CVE-2025-14287 [HIGH] CWE-94 CVE-2025-14287: A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in th A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using `os.system()`. This allow

CVE-2026-2651 [CRITICAL] CWE-862 CVE-2026-2651: A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can l

CVE-2023-6568 [MEDIUM] CWE-79 CVE-2023-6568: A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifi A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading t

CVE-2026-8147 [HIGH] CWE-284 CVE-2026-8147: In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoint In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. T

CVE-2024-0520 [HIGH] CWE-22 CVE-2024-0520: A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neut A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a dataset from a source URL with an HTTP scheme, the filename extracted from the `Content-Disposit

CVE-2024-37061 [HIGH] CWE-94 CVE-2024-37061: Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run.

CVE-2023-6975 [CRITICAL] CWE-29 CVE-2023-6975: A malicious user could use this issue to get command execution on the vulnerable machine and get acc A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.

CVE-2024-3573 [CRITICAL] CWE-29 CVE-2024-3573: mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exp

CVE-2023-6976 [HIGH] CWE-434 CVE-2023-6976: This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote file This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

CVE-2024-37060 [HIGH] CWE-502 CVE-2024-37060: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27. Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.

CVE-2024-37054 [HIGH] CWE-502 CVE-2024-37054: Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.

CVE-2024-37055 [HIGH] CWE-502 CVE-2024-37055: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24. Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.

CVE-2026-4035 [HIGH] CWE-201 CVE-2026-4035: A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment v A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the `api_key` field in gateway secrets can accept `$ENV_VAR` references, which

CVE-2023-6015 [HIGH] CWE-22 CVE-2023-6015: MLflow allowed arbitrary files to be PUT onto the server. MLflow allowed arbitrary files to be PUT onto the server.

CVE-2024-37052 [HIGH] CWE-502 CVE-2024-37052: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.

CVE-2024-37057 [HIGH] CWE-502 CVE-2024-37057: Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0 Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.

CVE-2024-37053 [HIGH] CWE-502 CVE-2024-37053: Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.