MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Command Injection in mlflow/mlflow

Path Traversal Vulnerability in mlflow/mlflow

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0

Missing Authentication for Critical Function in mlflow/mlflow

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

MLflow Weak Password Requirements Authentication Bypass Vulnerability

A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim…

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment

An attacker can overwrite any file on the server hosting MLflow without any authentication

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1

Improper Origin Validation in mlflow/mlflow

Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset

Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe

mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system

Path Traversal Vulnerability in mlflow/mlflow

Missing Authorization Validation in mlflow/mlflow

MLflow Experiment-scoped Label Schema CRUD API authorization

Command Injection in mlflow/mlflow

A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection')…

Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary…

Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary…

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process

with only one user interaction(download a malicious config), attackers can gain full command execution on the victim system

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2

Authentication Bypass in mlflow/mlflow

Authorization Bypass in mlflow/mlflow

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality

Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2

Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow

Command Injection in mlflow/mlflow

OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0

Environment Variable Resolution Vulnerability in mlflow/mlflow

Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow

In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack

A path traversal vulnerability exists in mlflow/mlflow version 2.15.1

A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3

A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909