Lfprojects Mlflow vulnerabilities

CVE-2026-69148 [HIGH] CWE-862 MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id ### Summary The `_validate_source_run` and `_validate_source_model` functions in `mlflow/server/handlers.py` verify that a model version source path is within the artifact directory of a specified run or logged model, but do not check whether the caller has READ permission

CVE-2026-3198 [MEDIUM] CWE-284 CVE-2026-3198: MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for mul MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the `BEFORE_REQUEST_HANDLERS` dictionary in `mlflow/server/auth/__init__.py` does not include entries for `ListGatewaySecretInfos`, `ListGatewayEndpoints`, and `ListGatewayModelDefinitions`. This allows

CVE-2025-10279 [HIGH] CWE-379 CVE-2025-10279: In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is a In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This vulnerability allows an attacker with write access to the `/tmp` directory to exploit a race condition and overwrite `.py` files in the virtual environment, leading to arbitrary code execution. T

CVE-2026-69146 [MEDIUM] CWE-862 MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth ### Summary When MLflow is deployed with the built-in basic-auth plugin (`--app-name basic-auth`), any authenticated user can inject arbitrary dataset records into another user's run by calling `POST /api/2.0/mlflow/runs/log-inputs`. The `LogInputs` proto handler is absent from the `BEFORE_REQUEST_HANDLERS`

CVE-2022-0736 [HIGH] CWE-377 CVE-2022-0736: Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1. Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.

CVE-2024-27134 [HIGH] CWE-276 CVE-2024-27134: Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

CVE-2025-1473 [HIGH] CWE-352 CVE-2025-1473: A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow vers A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user.

CVE-2024-4263 [MEDIUM] CWE-284 CVE-2024-4263: A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low priv A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. Th

CVE-2025-1474 [MEDIUM] CWE-521 CVE-2025-1474: In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a passw In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

CVE-2025-52967 [MEDIUM] CWE-918 CVE-2025-52967: gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation. gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.

CVE-2026-33865 [MEDIUM] CWE-79 CVE-2026-33865: MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLm MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations

CVE-2024-6838 [MEDIUM] CWE-400 CVE-2024-6838: In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in th

CVE-2026-33866 [MEDIUM] CWE-862 CVE-2026-33866: MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved m MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.1

CVE-2026-10803 [LOW] CWE-327 CVE-2026-10803: A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_uti A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is considered to have high complexity. The exploitability

CVE-2023-1176 [LOW] CWE-36 CVE-2023-1176: Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2. Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.2.2.