mlflow vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited mlflow flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-64849 MLflow Server-Side Request ForgeryExploited since Aug 19, 2026 · CVSS 9.3

Latest high and critical flaws

• CVE-2026-116692 MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.Critical 9.8 · Oct 27, 2026
• CVE-2026-116690 MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.High 7.5 · Oct 27, 2026
• CVE-2026-53995 MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem High 8.8 · Oct 19, 2026
• CVE-2026-96804 MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which alloHigh 8.8 · Sep 23, 2026
• CVE-2026-96775 MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which alloHigh 8.8 · Sep 23, 2026
• CVE-2026-79721 Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary cHigh 8.6 · Sep 8, 2026
• CVE-2026-69148 MLflow is an open source AI engineering platform for agents, large language models, and machine learning models.High 7.1 · Aug 17, 2026
• CVE-2026-64849 MLflow Server-Side Request ForgeryExploited · Critical 9.3 · Aug 17, 2026
• CVE-2026-71211 MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation High 7.1 · Aug 5, 2026
• CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators.High 8.1 · Jul 2, 2026
• CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exHigh 7.7 · Jun 3, 2026
• CVE-2026-2651 A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled.Critical 9 · May 25, 2026
• CVE-2026-2611 In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints.Critical 9.6 · May 19, 2026
• CVE-2026-4137 In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-wHigh 7.8 · May 18, 2026
• CVE-2026-2652 A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authenticatiHigh 8.6 · May 14, 2026
• CVE-2026-2614 A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated reHigh 7.5 · May 11, 2026
• CVE-2026-2393 A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0.High 7.1 · May 11, 2026
• CVE-2026-0545 In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enablCritical 9.8 · Apr 3, 2026
• CVE-2026-0596 A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`.High 7.8 · Mar 31, 2026
• CVE-2025-15379 A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` funCritical 10 · Mar 30, 2026
• CVE-2025-15036 A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow Critical 10 · Mar 29, 2026
• CVE-2025-15381 In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators.High 7.1 · Mar 27, 2026
• CVE-2025-15031 A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries.Critical 9.1 · Mar 18, 2026
• CVE-2025-14287 A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167.High 8.8 · Mar 16, 2026
• CVE-2026-2635 MLflow Use of Default Password Authentication Bypass Vulnerability.High 7.3 · Feb 20, 2026