Description Summary:
MLflow versions prior to 3 are vulnerable to a security flaw, necessitating an immediate review of vendor-provided security updates to mitigate potential risks.

Executive Summary:
MLflow versions prior to 3 contain an unspecified vulnerability that requires immediate attention to ensure the integrity and security of machine learning operations.

Vulnerability Details

CVE-ID: CVE-2026-8147

Affected Software: MLflow MLflow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability exists in MLflow versions prior to 3. The specific technical nature of the flaw is not publicly detailed, but it requires investigation into the software's authentication and access control mechanisms to determine if the flaw is exploitable by unauthenticated or authenticated actors.

Business Impact

With a CVSS score of 8.1, this vulnerability is categorized as High. A successful exploit could lead to significant unauthorized access to sensitive machine learning models, training data, or infrastructure, potentially resulting in data exfiltration, model poisoning, or severe operational disruption.

Remediation Plan

Immediate Action: Upgrade to version 3 or the latest available version provided by the vendor immediately.

Proactive Monitoring: Review access logs for unusual patterns or unauthorized attempts to access MLflow API endpoints or administrative interfaces.

Compensating Controls: Implement strict network segmentation and ensure that the MLflow instance is not exposed to the public internet without robust authentication proxies.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 3, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the high CVSS score, the potential for exploitation is high.

Analyst Recommendation

Given the High severity rating, organizations utilizing MLflow must prioritize the transition to version 3 or higher. Administrators should verify their current deployment version and apply necessary patches as soon as they are made available by the vendor to prevent unauthorized access to critical data assets.

Description Summary:
MLflow contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to reach internal services due to improper validation of redirected URLs.

Executive Summary:
A Server-Side Request Forgery vulnerability in MLflow versions prior to 3.15.0 allows unauthenticated remote attackers to access internal network resources and cloud metadata services.

Vulnerability Details

CVE-ID: CVE-2026-64849

Affected Software: mlflow mlflow

Affected Versions: < 3.15.0

Vulnerability: The vulnerability exists in the webhook test functionality, which validates the initial URL but fails to pin the address after following redirects. An unauthenticated attacker can supply a malicious URL that redirects to internal infrastructure, bypassing security controls.

Business Impact

An attacker can use this SSRF to scan internal network segments, access sensitive cloud metadata services, or interact with other internal APIs. Given the critical CVSS score of 9.3, the ability for an unauthenticated attacker to pivot into internal infrastructure presents a major risk of data exfiltration and further compromise.

Remediation Plan

Immediate Action: Update MLflow to version 3.15.0 or later to ensure proper validation of redirected webhook URLs.

Proactive Monitoring: Monitor egress traffic from MLflow servers for connections to internal IP addresses or unauthorized cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Use a Web Application Firewall or egress filtering to block requests originating from the MLflow service to internal or sensitive network ranges.

Exploitation Status

Public Exploit Available: exploit_available (unknown)

Analyst Notes: As of August 17, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. SSRF vulnerabilities are frequently targeted to gain access to cloud environments, making this an urgent security concern.

Analyst Recommendation

The risk of unauthorized internal access via this SSRF vulnerability is high. Administrators must update to the latest version of MLflow immediately and implement network-level egress restrictions as a defense-in-depth measure until the update is deployed.

Description Summary:
MLflow versions prior to 3.11.0 are vulnerable to the creation of temporary files with insecure permissions, potentially allowing local attackers to gain unauthorized access to sensitive information.

Executive Summary:
MLflow versions prior to 3.11.0 contain a vulnerability involving insecure temporary file permissions that could lead to unauthorized local data access.

Vulnerability Details

CVE-ID: CVE-2026-4137

Affected Software: MLflow

Affected Versions: mlflow mlflow/mlflow: unspecified up to (excluding) 3.11.0

Vulnerability: This is an insecure file permission issue (CWE-378) where temporary files are created with overly permissive access rights. Exploitation requires local access to the system (AV:L) and specific conditions regarding the local environment.

Business Impact

While the attack vector requires local access, successful exploitation could allow an attacker to read or modify sensitive temporary data, potentially leading to privilege escalation or the theft of credentials stored within the MLflow workspace. The CVSS score of 7.0 (High) reflects the potential for full compromise of the affected local environment.

Remediation Plan

Immediate Action: Update the MLflow package to version 3.11.0 or later to ensure temporary files are created with appropriate, restrictive system permissions.

Proactive Monitoring: Monitor local file system activity for unexpected file creation or access patterns within temporary directories used by MLflow services.

Compensating Controls: Implement strict OS-level access controls and ensure that the service runs with the least privilege necessary, minimizing the impact if a local attacker attempts to leverage insecure files.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for local access naturally limits the attack surface to multi-user or compromised-host scenarios.

Analyst Recommendation

Administrators should prioritize updating to the patched version 3.11.0 to close this local security gap. Ensure that all systems running MLflow are hardened with appropriate file system permissions to further mitigate risk.

Description Summary:
An authentication bypass vulnerability exists in mlflow/mlflow versions prior to 3.10.0, potentially allowing unauthorized access to system functions.

Executive Summary:
A critical authentication bypass vulnerability in mlflow allows unauthenticated remote attackers to potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-2652

Affected Software: mlflow mlflow

Affected Versions: Unspecified up to (excluding) 3.10.0

Vulnerability: The flaw is an authentication bypass (CWE-305) that permits unauthenticated remote attackers to interact with the application. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms that no user interaction or prior authentication is required to exploit this vulnerability.

Business Impact

With a CVSS score of 8.6, this vulnerability poses a high risk to business operations. Successful exploitation allows for unauthorized system interaction, which could lead to data exfiltration, unauthorized modification of machine learning models, or service disruption, directly threatening the integrity of data science pipelines.

Remediation Plan

Immediate Action: Update the mlflow package to version 3.11.0 or higher as specified by the OSV record.

Proactive Monitoring: Monitor network traffic for unusual API requests to the mlflow server and review access logs for successful requests originating from unknown or unauthorized IP addresses.

Compensating Controls: Implement strict network access control lists (ACLs) to restrict access to the mlflow instance to trusted internal networks or VPNs only.

Exploitation Status

Public Exploit Available: No (Nuclei template only).

Analyst Notes: As of May 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. While no weaponized exploit is currently known, the existence of a Nuclei detection template suggests the vulnerability is being actively scanned for by threat actors.

Analyst Recommendation

Given the ease of exploitability (low complexity, no authentication required) and the presence of a public proof-of-concept, organizations should prioritize patching immediately. Ensure all mlflow deployments are updated to version 3.11.0 to eliminate this critical security gap.

Description Summary:
MLflow contains a critical authentication bypass vulnerability due to hard-coded default credentials in the basic_auth.ini file, allowing remote attackers to gain administrative access.

Executive Summary:
A critical authentication bypass in MLflow allows unauthenticated remote attackers to gain full administrative control and execute arbitrary code by exploiting hard-coded default credentials.

Vulnerability Details

CVE-ID: CVE-2026-2635

Affected Software: MLflow

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This flaw stems from the use of hard-coded default credentials within the basic_auth.ini configuration file. An unauthenticated remote attacker can exploit this weakness to bypass standard security protocols and execute arbitrary code with the privileges of the administrator.

Business Impact

A successful exploit poses a catastrophic risk to the organization’s machine learning pipeline and underlying infrastructure. Attackers can gain unauthorized access to sensitive models, manipulate data, or achieve full remote code execution (RCE). Given the CVSS score of 9.8, this vulnerability represents a critical threat to data integrity and system availability.

Remediation Plan

Immediate Action: Update MLflow to the latest secure version immediately and ensure that the default credentials in basic_auth.ini are changed to strong, unique values.

Proactive Monitoring: Review access logs for any unauthorized logins using default accounts and monitor for unusual administrative activities or unexpected code execution patterns.

Compensating Controls: Restrict access to the MLflow management interface using network-level access control lists (ACLs) or a VPN to ensure only trusted IPs can reach the service.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the simplicity of exploiting default credentials, the potential for widespread exploitation is extremely high.

Analyst Recommendation

The severity of this vulnerability cannot be overstated, as it grants complete control over the MLflow environment without requiring any prior authentication. Organizations must prioritize the rotation of all default credentials and update the software to the latest version immediately to mitigate the risk of administrative takeover.

Description Summary:
A path traversal vulnerability in the _create_model_version() handler of MLflow allows unauthenticated attackers to access restricted files on the server.

Executive Summary:
An unauthenticated path traversal vulnerability in MLflow versions prior to 3.10.0 allows attackers to read sensitive files, posing a critical risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-2614

Affected Software: MLflow

Affected Versions: All versions prior to 3.10.0

Vulnerability: The _create_model_version() handler fails to properly sanitize path inputs (CWE-22), allowing unauthenticated remote attackers to perform path traversal attacks to access unauthorized files.

Business Impact

This vulnerability could lead to the unauthorized disclosure of sensitive server-side configuration files, credentials, or model data. With a CVSS score of 7.5, the risk of data compromise is significant, potentially leading to full system compromise if attackers successfully exfiltrate sensitive environment information.

Remediation Plan

Immediate Action: Update MLflow to version 3.10.0 or later immediately to apply the required input sanitization fixes.

Proactive Monitoring: Monitor server access logs for path traversal patterns (e.g., ../ sequences) directed at the model versioning API endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block requests containing directory traversal sequences or suspicious path characters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

Given the availability of a patch and the presence of a proof-of-concept, upgrading to MLflow 3.10.0 is the highest priority. Organizations should complete this update as soon as possible to prevent potential exploitation of the path traversal flaw.

Description Summary:
A cross-origin validation error in the MLflow Assistant allows remote attackers to execute arbitrary commands on a user's local machine via malicious web pages.

Executive Summary:
A critical origin validation vulnerability in the MLflow Assistant allows remote attackers to bypass security controls and execute arbitrary commands on local systems, necessitating an immediate upgrade.

Vulnerability Details

CVE-ID: CVE-2026-2611

Affected Software: MLflow

Affected Versions: Up to (excluding) 3.10.0

Vulnerability: This vulnerability (CWE-346) stems from improper origin validation within the MLflow Assistant’s /ajax-api endpoints. By exploiting cross-origin requests, a remote attacker can trick a user's browser into interacting with the local MLflow instance, modifying configuration settings to enable full access and executing commands via the Claude Code sub-agent.

Business Impact

The CVSS score of 9.6 highlights a critical risk to local workstations and integrated development environments. A successful exploit could lead to the theft of sensitive API keys, source code, or internal data, as well as the execution of arbitrary commands in the context of the user’s machine. This is particularly dangerous for developers and data scientists who utilize MLflow for local model development.

Remediation Plan

Immediate Action: Upgrade MLflow to version 3.10.0 or later immediately to resolve the origin validation errors.

Proactive Monitoring: Review browser logs and network traffic for suspicious cross-origin requests directed toward local MLflow instances.

Compensating Controls: Use browser extensions or firewall policies to restrict cross-origin requests and disable the MLflow Assistant feature if it is not required for current workflows.

Exploitation Status

Public Exploit Available: Yes (Proof-of-Concept)

Analyst Notes: As of May 19, 2026, proof-of-concept code is available for this vulnerability. Given the ease with which local systems can be targeted via malicious web content, the urgency for remediation is high.

Analyst Recommendation

Organizations using MLflow for local development must upgrade to version 3.10.0 immediately. The presence of a proof-of-concept exploit significantly increases the risk of successful targeting; applying the update is the only effective way to mitigate the risk of arbitrary code execution.

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in MLflow allows authenticated attackers to perform unauthorized requests.

Executive Summary:
A Server-Side Request Forgery (SSRF) vulnerability in MLflow versions prior to 3.10.0 poses a risk of unauthorized internal network access by authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-2393

Affected Software: MLflow

Affected Versions: Up to (excluding) 3.10.0

Vulnerability: This vulnerability is a Server-Side Request Forgery (CWE-918) flaw. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates that an attacker with low-level privileges can exploit the system over the network without user interaction.

Business Impact

Successful exploitation could allow an attacker to interact with internal services or APIs that are otherwise inaccessible from the public network. Given the CVSS score of 7.1, this is a High severity issue that could lead to unauthorized data exposure or the orchestration of further attacks against internal infrastructure.

Remediation Plan

Immediate Action: Update MLflow to version 3.9.0 or later to ensure the vulnerability is patched.

Proactive Monitoring: Review application access logs for unusual outbound requests originating from the MLflow service to internal, non-public IP addresses.

Compensating Controls: Implement strict egress filtering on the network segment hosting MLflow to restrict unauthorized outbound connections to internal resources.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of May 12, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw's inherent design allows for potential abuse of server-side requests if input validation is insufficient.

Analyst Recommendation

Organizations utilizing MLflow should prioritize updating to version 3.9.0 immediately. The availability of proof-of-concept material increases the likelihood of exploitation, making prompt remediation essential to preventing internal network compromise.

Description Summary:
MLflow Tracking Server is vulnerable to a directory traversal flaw in the artifact handler, allowing unauthenticated remote attackers to execute arbitrary code.

Executive Summary:
An unauthenticated remote code execution vulnerability in the MLflow Tracking Server poses a critical risk to data integrity and system control.

Vulnerability Details

CVE-ID: CVE-2026-2033

Affected Software: MLflow Tracking Server

Affected Versions: 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f

Vulnerability: The vulnerability is caused by improper input validation of user-supplied paths within the artifact handler, which leads to path traversal. This allows an unauthenticated attacker to manipulate file operations to achieve remote code execution under the context of the service account.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host server without any authentication. This could lead to a complete system compromise, unauthorized access to sensitive machine learning models and training data, and potential lateral movement within the network. Given the CVSS score of 8.1, the high potential for total impact necessitates immediate attention.

Remediation Plan

Immediate Action: Review the official MLflow repository and vendor advisories for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Monitor server access logs for suspicious file paths or directory traversal patterns, such as sequences involving double dots or unexpected system file references.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts targeted at the MLflow artifact handling endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication and the potential for direct code execution.

Analyst Recommendation

This vulnerability represents a significant security exposure due to its unauthenticated nature and the high severity of the potential impact. Organizations utilizing MLflow Tracking Server should prioritize isolating these systems from public-facing networks until a patch is verified and applied. Continuous monitoring of logs is essential to detect any early signs of exploitation attempts while awaiting a formal vendor fix.

Description Summary:
MLflow is vulnerable to command injection when serving models with enable_mlserver=True. Shell metacharacters in the model_uri allow for arbitrary code execution via bash -c.

Executive Summary:
Attackers can execute arbitrary shell commands on an MLflow model server by providing a crafted model URI, potentially leading to full system compromise and privilege escalation.

Vulnerability Details

CVE-ID: CVE-2026-0596

Affected Software: MLflow

Affected Versions: See vendor advisory for specific affected versions (affects latest at time of report)

Vulnerability: A command injection vulnerability exists in the model serving component. When enable_mlserver=True is set, the model_uri parameter is passed unsanitized to a shell command. An attacker can use shell metacharacters like $() or backticks to execute arbitrary code with the privileges of the MLflow service.

Business Impact

A successful exploit allows an attacker to take control of the machine serving the machine learning models. This can lead to the theft of proprietary models, training data, or sensitive environment variables. Furthermore, if the service is running with high privileges, the attacker can achieve full host escalation. The CVSS score of 9.6 reflects this critical impact on ML infrastructure.

Remediation Plan

Immediate Action: Update MLflow to the latest version containing the fix. If an update is not immediately possible, disable enable_mlserver or strictly validate all model_uri inputs.

Proactive Monitoring: Monitor system logs for suspicious bash processes spawned by the MLflow service and audit all model deployment requests for unusual characters.

Compensating Controls: Run MLflow model serving in a low-privileged, isolated container environment to limit the impact of a successful command injection.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of March 31, 2026, there is no public information indicating active exploitation. Command injection in ML pipelines is an emerging threat as these systems become more integrated into production environments.

Analyst Recommendation

Machine learning infrastructure often has access to sensitive data and significant compute resources. Organizations must ensure that MLflow is patched and that model deployment is restricted to authorized users. Prioritize the update to the latest version to close this critical command injection vector.

Description Summary:
An authentication bypass in MLflow's FastAPI job endpoints allows unauthenticated attackers to submit and execute jobs, potentially leading to remote code execution or denial of service.

Executive Summary:
MLflow installations are subject to a critical authentication bypass in job management endpoints, potentially leading to unauthenticated remote code execution and full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-0545

Affected Software: MLflow MLflow

Affected Versions: Latest version (at time of disclosure)

Vulnerability: The /ajax-api/3.0/jobs/* endpoints bypass basic-auth protections. If job execution is enabled, unauthenticated attackers can manage jobs, which may lead to shell execution or unauthorized filesystem access.

Business Impact

This vulnerability could allow an attacker to execute arbitrary code on the MLflow server, steal sensitive machine learning models, or disrupt operations through job spam. The CVSS score of 9.1 reflects the critical risk of unauthenticated access to privileged functions.

Remediation Plan

Immediate Action: Update MLflow to the latest version. If a patch is unavailable, disable job execution by setting MLFLOW_SERVER_ENABLE_JOB_EXECUTION=false immediately.

Proactive Monitoring: Review MLflow logs for job submissions from unknown IP addresses and monitor the server for unauthorized shell activity.

Compensating Controls: Implement an external authentication proxy or restrict access to the MLflow server using network-level firewalls and VPNs.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 3, 2026, there is no public information indicating active exploitation. The vulnerability is particularly dangerous because it bypasses the standard authentication mechanism used by the application.

Analyst Recommendation

The potential for unauthenticated remote code execution makes this a critical priority. Organizations must either apply the latest security updates or disable the vulnerable job execution feature until a fix is verified.

Description Summary:
MLflow tracing and assessment endpoints lack required permission validators when basic-auth is enabled, allowing unauthorized access to sensitive trace data and assessment creation.

Executive Summary:
A high-severity authentication bypass vulnerability in MLflow allows authenticated users to access sensitive trace metadata and manipulate assessments without proper authorization.

Vulnerability Details

CVE-ID: CVE-2025-15381

Affected Software: MLflow MLflow

Affected Versions: Unspecified through latest

Vulnerability: This vulnerability involves an improper authorization flaw, classified as CWE-200, occurring when the basic-auth application is enabled. It allows any authenticated user, including those with no assigned permissions, to perform unauthorized read and write operations on trace and assessment endpoints.

Business Impact

The vulnerability poses a significant risk to data confidentiality and integrity by exposing sensitive trace information to unauthorized users. A successful exploit could lead to the leakage of proprietary model metadata or the unauthorized injection of assessments, potentially compromising the integrity of machine learning workflows. With a CVSS score of 8.1, this flaw represents a high risk to organizations relying on MLflow for sensitive data processing.

Remediation Plan

Immediate Action: Monitor vendor security channels for the release of an official patch, and restrict access to the MLflow server to trusted networks until a fix is deployed.

Proactive Monitoring: Review access logs for suspicious requests to trace and assessment endpoints, particularly from users identified as having restricted or no permissions.

Compensating Controls: Implement network-level access controls or a Web Application Firewall (WAF) to restrict traffic to the affected endpoints, ensuring only authorized personnel can communicate with the MLflow server.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of March 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally an authorization oversight that requires a pre-existing authenticated session to exploit.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized access to sensitive machine learning artifacts, this issue should be prioritized for remediation. Administrators must remain vigilant for vendor updates and apply the necessary patches as soon as they become available to restore proper access control enforcement.

Description Summary:
A command injection vulnerability in MLflow's model serving container initialization allows attackers to execute arbitrary commands by supplying malicious model artifacts with unsanitized dependencies.

Executive Summary:
MLflow version 3.8.0 is subject to a critical command injection vulnerability that allows an attacker to achieve full system compromise through the deployment of malicious model artifacts.

Vulnerability Details

CVE-ID: CVE-2025-15379

Affected Software: MLflow

Affected Versions: 3.8.0

Vulnerability: This flaw exists in the _install_model_dependencies_to_env() function where dependency specifications from python_env.yaml are interpolated into shell commands without sanitization. An attacker with the ability to supply or register a malicious model artifact can trigger arbitrary code execution when the model is deployed using the LOCAL environment manager.

Business Impact

A successful exploit grants the attacker the same privileges as the MLflow service, potentially leading to total loss of confidentiality, integrity, and availability. Given the CVSS score of 10.0, this represents the highest possible risk, as it could allow for data exfiltration, lateral movement within the infrastructure, and permanent system damage.

Remediation Plan

Immediate Action: Upgrade MLflow to version 3.8.2 or later immediately to patch the vulnerable container initialization logic.

Proactive Monitoring: Review system logs for unusual shell command execution originating from the MLflow model serving process and monitor for unauthorized model registration activities.

Compensating Controls: Restrict model deployment permissions to trusted personnel and implement network segmentation to isolate model serving containers from sensitive internal resources.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and the ease with which a malicious artifact can be crafted, the potential for exploitation is extremely high.

Analyst Recommendation

The severity of this command injection flaw cannot be overstated, as indicated by the CVSS 10.0 rating. Organizations utilizing MLflow for model serving must prioritize the update to version 3.8.2 to mitigate the risk of arbitrary command execution and potential infrastructure takeover.

Description Summary:
A path traversal vulnerability in MLflow's archive extraction function allows attackers to overwrite arbitrary files and escape sandboxed directories via malicious tar archives.

Executive Summary:
MLflow versions prior to v3.7.0 are vulnerable to a critical path traversal flaw that enables attackers to overwrite system files and potentially escape sandbox environments.

Vulnerability Details

CVE-ID: CVE-2025-15036

Affected Software: MLflow

Affected Versions: Versions before v3.7.0

Vulnerability: The vulnerability resides in the extract_archive_to_dir function within the artifact cache component, which fails to validate member paths during tar extraction. An attacker who can upload or provide a specially crafted tar.gz file can use directory traversal sequences (e.g., ../) to write files outside the intended directory.

Business Impact

Successful exploitation can lead to arbitrary file overwrites, which may result in privilege escalation, system instability, or full sandbox escape in multi-tenant environments. The CVSS score of 9.6 highlights the critical nature of this vulnerability and the high risk of unauthorized data access and system compromise.

Remediation Plan

Immediate Action: Upgrade MLflow to version v3.7.0 or higher to implement proper path validation during archive extraction.

Proactive Monitoring: Scan the file system for unexpected files created outside of the MLflow artifact directories and monitor for suspicious file write operations.

Compensating Controls: Use containerization with restricted file system permissions (read-only where possible) to limit the impact of a successful path traversal attack.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 30, 2026, there is no public information indicating active exploitation of this vulnerability. The flaw is a classic path traversal issue, which is frequently targeted by attackers in shared or multi-tenant cloud environments.

Analyst Recommendation

The ability to overwrite arbitrary files poses a significant risk to the integrity of the MLflow platform. It is strongly recommended that all users update to version v3.7.0 immediately to mitigate the risk of sandbox escapes and unauthorized system modification.

Description Summary:
MLflow is vulnerable to arbitrary file writes via path traversal in the pyfunc extraction process, potentially leading to remote code execution.

Executive Summary:
A critical path traversal vulnerability in MLflow allows unauthenticated attackers to perform arbitrary file writes, posing a severe risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2025-15031

Affected Software: MLflow

Affected Versions: Unspecified through latest (prior to 3.9.0rc0)

Vulnerability: The flaw exists in the pyfunc extraction process due to improper handling of tar archive entries. By using tarfile.extractall without path validation, an unauthenticated attacker can supply crafted tar.gz files containing directory traversal sequences to overwrite files outside the intended directory.

Business Impact

Successful exploitation of this vulnerability allows an attacker to overwrite critical system files, which can be leveraged to achieve remote code execution. Given the CVSS score of 8.1, this represents a high-severity risk, particularly in multi-tenant environments or systems that ingest untrusted artifacts. Unauthorized access to the underlying host could lead to total compromise of the application environment and sensitive data theft.

Remediation Plan

Immediate Action: Update the MLflow package to version 3.9.0rc0 or later to implement proper path validation for tar archive extraction.

Proactive Monitoring: Monitor application logs for unusual file system write operations or unexpected attempts to access directories outside of designated artifact storage locations.

Compensating Controls: Implement strict input validation for all uploaded artifacts and ensure the application runs with the minimum necessary privileges to limit the impact of a potential file system overwrite.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit or weaponized module; per CISA's SSVC assessment, a proof-of-concept exists).

Analyst Notes: As of March 20, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The reliance on unsafe archive extraction methods makes this a significant vector for attackers targeting automated machine learning pipelines.

Analyst Recommendation

The severity of this vulnerability, combined with the potential for remote code execution, necessitates immediate attention. Organizations utilizing MLflow to process external artifacts must prioritize upgrading to the patched version. Until updates are applied, restrict artifact ingestion to trusted sources only to mitigate the risk of exploitation.

Description Summary:
A command injection vulnerability in MLflow versions before 3.7.0 allows local attackers to execute arbitrary system commands via malicious container image names.

Executive Summary:
A critical command injection vulnerability in MLflow allows authenticated local attackers to execute arbitrary code on the host system, posing a significant risk to CI/CD and deployment environments.

Vulnerability Details

CVE-ID: CVE-2025-14287

Affected Software: MLflow

Affected Versions: Versions before 3.7.0

Vulnerability: The vulnerability exists in the mlflow/sagemaker/__init__.py file, where user-supplied container image names are passed directly into os.system() shell commands without sanitization. An attacker with local access can exploit this by providing a malicious string through the --container parameter of the MLflow CLI.

Business Impact

The ability to execute arbitrary commands on a system running MLflow can lead to full system compromise, data theft, and unauthorized manipulation of machine learning models. Given the CVSS score of 7.5, this high-severity flaw threatens the integrity of CI/CD pipelines and cloud deployment infrastructures, potentially allowing attackers to pivot deeper into the corporate network.

Remediation Plan

Immediate Action: Update MLflow to version 3.8.0rc0 or later to include the necessary input sanitization fixes.

Proactive Monitoring: Audit logs for the MLflow CLI, specifically monitoring for unusual characters or shell syntax within the --container parameter inputs.

Compensating Controls: Restrict access to the MLflow CLI to authorized users only and implement strict input validation at the application layer if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the Huntr security bounty report.

Analyst Notes: As of March 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the direct usage of unsanitized user input in a system execution function.

Analyst Recommendation

This vulnerability presents a clear path for arbitrary command execution, which could result in a total compromise of the affected MLflow environment. It is imperative that security teams verify their MLflow deployment versions immediately and apply the 3.8.0rc0 patch to mitigate this risk. Priority should be given to protecting systems used within CI/CD pipelines and cloud-based production environments.

Description Summary:
MLFlow versions up to 3.4.0 are vulnerable to DNS rebinding attacks due to missing Origin header validation in the REST server, allowing unauthorized operations against experiment endpoints.

Executive Summary:
A critical security vulnerability in MLFlow allows unauthenticated attackers to bypass Same-Origin Policy protections through DNS rebinding, enabling unauthorized manipulation or exfiltration of experiment data.

Vulnerability Details

CVE-ID: CVE-2025-14279

Affected Software: MLFlow

Affected Versions: Up to (excluding) 3.5.0

Vulnerability: The vulnerability is caused by a failure to validate the Origin header in the MLFlow REST server, which exposes the system to DNS rebinding attacks. This flaw allows an unauthenticated attacker to execute unauthorized REST API calls, including querying, updating, or deleting sensitive experiment data.

Business Impact

The exploitation of this vulnerability could lead to the complete compromise of machine learning experiment data, including the destruction or unauthorized modification of proprietary models and datasets. Given the CVSS score of 8.1, the risk of data exfiltration and integrity loss is significant, potentially resulting in severe operational disruption and loss of intellectual property.

Remediation Plan

Immediate Action: Update the MLFlow installation to version 3.5.0 or later to implement the required Origin header validation.

Proactive Monitoring: Review web server access logs for anomalous requests originating from unexpected domains or patterns indicative of DNS rebinding attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) or configure reverse proxy rules to strictly validate the Host and Origin headers of incoming requests until the patch can be applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of January 13, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The vulnerability requires user interaction via a malicious website, but the lack of origin validation makes it a highly accessible attack vector for remote actors.

Analyst Recommendation

The vulnerability represents a high risk to data integrity and confidentiality within MLFlow environments. Organizations should prioritize the update to version 3.5.0 immediately to remediate the underlying lack of origin validation. If patching is not immediately feasible, network-level controls to restrict access to the REST interface are strongly advised.

Description Summary:
A directory traversal vulnerability in the MLflow Tracking Server allows unauthenticated remote attackers to execute arbitrary code via improper validation of model file paths.

Executive Summary:
An unauthenticated remote code execution vulnerability exists in the MLflow Tracking Server that requires immediate patching to prevent full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-11201

Affected Software: MLflow Tracking Server

Affected Versions: MLflow 2.21.3

Vulnerability: This vulnerability is a path traversal flaw, identified as CWE-22, occurring within the model file path handling logic. It permits an unauthenticated attacker to manipulate file operations to achieve remote code execution in the context of the service account.

Business Impact

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code on the host system, leading to a complete compromise of the server. Given the CVSS score of 8.1, the high potential for system-wide impact and unauthorized data access poses a significant threat to operational integrity and sensitive intellectual property stored within the MLflow environment.

Remediation Plan

Immediate Action: Update the MLflow package to version 3.0.0 or 2.22.4 immediately to resolve the directory traversal flaw.

Proactive Monitoring: Monitor server logs for unusual file system access patterns or unexpected child process spawning that may indicate an attempt to leverage directory traversal for code execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal sequences, such as dot-dot-slash patterns, directed at model creation endpoints.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of October 30, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While there is no confirmed public exploit, the nature of the flaw allows for relatively straightforward exploitation once the vulnerable endpoint is identified, necessitating prompt remediation.

Analyst Recommendation

The severity of this vulnerability, combined with the lack of required authentication, necessitates immediate action. Organizations utilizing MLflow Tracking Server must prioritize updating to the patched versions to eliminate the risk of remote code execution and maintain the security of their machine learning infrastructure.

Description Summary:
MLflow suffers from an authentication bypass vulnerability due to weak password requirements, allowing unauthenticated remote attackers to compromise the system.

Executive Summary:
A critical authentication bypass vulnerability in MLflow 2.21.0 allows unauthenticated remote attackers to gain unauthorized access to the platform.

Vulnerability Details

CVE-ID: CVE-2025-11200

Affected Software: MLflow

Affected Versions: 2.21.0

Vulnerability: The vulnerability is caused by weak password requirements, classified as CWE-521, which allows an unauthenticated remote attacker to bypass authentication mechanisms and potentially gain full control over the affected installation.

Business Impact

The ability for an unauthenticated attacker to bypass authentication poses a severe risk to data integrity, confidentiality, and system availability. Given the CVSS score of 8.1, this vulnerability could lead to the unauthorized extraction of machine learning models, training data, or administrative access to the underlying infrastructure. Organizations relying on MLflow for model lifecycle management face significant reputational and operational disruption if exploited.

Remediation Plan

Immediate Action: Update the MLflow package to version 2.22.0rc0 or later to resolve the password handling flaw.

Proactive Monitoring: Review system access logs for unusual login patterns or unauthorized administrative activity originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter suspicious traffic and enforce strict access control lists (ACLs) to restrict access to the MLflow interface until the update is applied.

Exploitation Status

Public Exploit Available: No (the available data does not confirm a public exploit).

Analyst Notes: As of October 30, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is fundamentally exploitable due to the lack of robust password enforcement, which bypasses standard security gates.

Analyst Recommendation

This vulnerability represents a significant security gap that enables unauthorized remote access. Security administrators must prioritize updating the MLflow environment to the patched version immediately. Failure to remediate this issue exposes the entire machine learning pipeline to potential takeover and unauthorized data access.

Description Summary:
A vulnerability in MLflow version 2 could lead to unauthorized access or data manipulation within the machine learning lifecycle platform.

Executive Summary:
MLflow version 2 is affected by a High-severity vulnerability that could allow attackers to compromise machine learning experiments and data.

Vulnerability Details

CVE-ID: CVE-2025-10279

Affected Software: MLflow

Affected Versions: Version 2

Vulnerability: This vulnerability affects MLflow, an open-source platform for the machine learning lifecycle. With a CVSS score of 7.0, the flaw likely involves insecure deserialization, path traversal, or improper access control within the MLflow tracking server or UI.

Business Impact

The compromise of an MLflow instance can lead to the loss or corruption of machine learning models, training parameters, and sensitive datasets. This impacts the integrity of AI-driven decision-making and can result in significant intellectual property theft.

Remediation Plan

Immediate Action: Update MLflow to the latest patched version immediately to address the identified security flaw.

Proactive Monitoring: Audit the MLflow tracking server for unauthorized experiment creation or unexpected modifications to existing model artifacts.

Compensating Controls: Deploy MLflow behind an authentication proxy (like Nginx with OIDC) to ensure that only authorized users can interact with the API and UI.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of February 3, 2026, there is no public information indicating active exploitation. MLflow is a critical tool in the MLOps pipeline, making it a high-value target for industrial espionage.

Analyst Recommendation

Organizations relying on MLflow for their AI workflows must prioritize this update. Applying the latest patch is essential to maintaining the confidentiality and integrity of the machine learning research and deployment pipeline.