Vulnerabilities for mlflow

First version without a known vulnerability: 3.15.0

Details

• GHSA-7gwp-5pfp-969j2026-08-17

  MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  Fixed in: 3.15.0

• GHSA-2cm6-r77w-6g962026-07-02

  MLflow: trace API endpoints lack proper authorization validators

  Fixed in: 3.13.0rc0

• GHSA-5qmp-p3c4-72qj2026-06-04

  MLflow: Deterministic sampling in dataset digest enables predictable collisions

  Fixed in: 3.10.1

• GHSA-g35p-px32-whv62026-06-03

  MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration

  Fixed in: 3.11.0

• GHSA-r5m9-wm49-959f2026-06-02

  MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions

  Fixed in: 3.11.0rc0

• GHSA-8c7q-86fq-vvmh2026-05-26

  MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

  Fixed in: 3.11.0rc1, 3.11.0rc0

• GHSA-w5xq-c4pf-ghq72026-05-21

  MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

  Fixed in: 3.10.0

• GHSA-67c5-x5mf-rppq2026-05-19

  MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

  Fixed in: 3.10.0

• GHSA-f2m9-wcf4-cwwx2026-05-18

  MLFlow Creates a Temporary File With Insecure Permissions

  Fixed in: 3.11.0

• GHSA-75cm-x2w3-8mgf2026-05-15

  MLflow: unauthenticated access to certain FastAPI routes

  Fixed in: 3.11.0, 3.10.0

• GHSA-42h5-h8qh-vv9v2026-05-11

  MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

  Fixed in: 3.10.0

• GHSA-65h7-c7c4-mghx2026-05-11

  MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability

  Fixed in: 3.9.0

• GHSA-46r5-x6jq-v8g62026-04-07

  MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint

  Fixed in: 3.11.0rc0

• GHSA-fh64-r2vc-xvhr2026-04-07

  MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface

  Fixed in: 3.11.1, 3.11.0rc0

• GHSA-7qhf-v65m-g5f32026-04-03

  mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

• GHSA-rvhj-8chj-8v3c2026-03-31

  Mlflow: Command Injection when serving models with enable_mlserver=True

  Fixed in: 3.9.0

• GHSA-r23q-823p-vmf72026-03-30

  MLflow Command Injection vulnerability

  Fixed in: 3.8.1

• GHSA-vhcx-3pq2-4fvc2026-03-30

  MLFlow path traversal vulnerability

  Fixed in: 3.9.0rc0

• GHSA-g6pg-52vf-843h2026-03-27

  MLFlow allows Tracing + Assessments Access

• GHSA-fhff-qmm8-h2fp2026-03-19

  Arbitrary file write via tar traversal in mlflow

  Fixed in: 3.9.0rc0

• GHSA-xch3-2f9x-wh9f2026-03-16

  MLflow has a command injection in mlflow/sagemaker/__init__.py

  Fixed in: 3.8.0rc0

• GHSA-gq3w-7jj3-x7gr2026-02-21

  MLflow Use of Default Password Authentication Bypass Vulnerability

  Fixed in: 3.8.0rc0

• GHSA-q2r8-vmq7-fpx22026-02-21

  MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability

  Fixed in: 3.8.0rc0

• GHSA-4x5p-f36r-mxxr2026-02-02

  mlflow Creates of Temporary File in Directory with Insecure Permissions

  Fixed in: 3.4.0rc0

• GHSA-pgqp-8h46-6x4j2026-01-12

  MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation

  Fixed in: 3.5.0

• GHSA-5cvj-7rg6-jggj2025-10-29

  MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

  Fixed in: 3.0.0, 2.22.4

• GHSA-6xj8-rrqx-r4cv2025-10-29

  MLflow Weak Password Requirements Authentication Bypass Vulnerability

  Fixed in: 2.22.0rc0

• GHSA-wxj7-3fx5-pp9m2025-06-23

  MLFlow SSRF via gateway_proxy_handler

  Fixed in: 3.1.0, 2.22.2, 39a419b4ec8fd11b59b3e50ab397042a490f2324

• GHSA-4rj2-9gcx-5qhx2025-03-20

  MLflow has Weak Password Requirements

  Fixed in: 2.19.0, 149c9e18aa219bc47e86b432e130e467a36f4a17

• GHSA-969w-gqqr-g6j32025-03-20

  MLflow Cross-Site Request Forgery (CSRF) vulnerability

  Fixed in: 2.20.3

• GHSA-49m6-vrr9-2cqm2025-03-20

  MLflow Uncontrolled Resource Consumption vulnerability

• GHSA-4rqf-8pfm-p36r2025-03-20

  MLflow has a Local File Read/Path Traversal in dbfs

  Fixed in: 2.17.0rc0

• GHSA-q3gw-8236-5jw42025-03-20

  MLflow Uncontrolled Resource Consumption vulnerability

• GHSA-qpgc-w4mg-6v922024-11-25

  MLflow's excessive directory permissions allow local privilege escalation

  Fixed in: 2.16.0

• GHSA-8f8q-q2j7-7j2m2024-06-06

  Undefined Behavior in mlflow

  Fixed in: 2.11.3

• GHSA-j46q-5pxx-8vmw2024-06-06

  Local File Inclusion in mlflow

  Fixed in: 2.11.3, 96f0b573a73d8eedd6735a2ce26e08859527be07

• GHSA-5q6c-ffvg-xcm92024-06-06

  Remote code execution in mlflow

  Fixed in: 2.9.0, 400c226953b4568f4361bc0a0c223511652c2b9d

• GHSA-cv6c-7963-wxcg2024-06-04

  MLFlow unsafe deserialization

• GHSA-cwgg-w6mp-w9hg2024-06-04

  MLFlow unsafe deserialization

• GHSA-j8mg-pqc5-x9gj2024-06-04

  MLFlow unsafe deserialization

• GHSA-pqcv-qw2r-r8592024-06-04

  MLFlow improper input validation

• GHSA-wf7f-8fxf-xfxc2024-06-04

  MLFlow unsafe deserialization

• GHSA-43c4-9qgj-x7422024-06-04

  MLFlow unsafe deserialization

• GHSA-76cg-cfhx-373f2024-06-04

  MLFlow unsafe deserialization

• GHSA-7p8j-qv6x-f4g42024-06-04

  MLFlow unsafe deserialization

• GHSA-ghv6-9r9j-wh4j2024-06-04

  MLFlow unsafe deserialization

• GHSA-x38x-g6gr-jqff2024-06-04

  MLFlow unsafe deserialization

• GHSA-p4jx-q62p-x5jr2024-05-16

  MLflow allows low privilege users to delete any artifact

  Fixed in: 2.10.1, b43e0e3de5b500554e13dc032ba2083b2d6c94b8

• GHSA-rfqq-wq6w-72jm2024-05-16

  MLflow has a Local File Read/Path Traversal bypass

  Fixed in: 2.12.1, f8d51e21523238280ebcfdb378612afd7844eca8

• GHSA-hq88-wg7q-gp4g2024-04-16

  mlflow vulnerable to Path Traversal

  Fixed in: 2.10.0, 438a450714a3ca06285eeea34bdc6cf79d7f6cbc

• GHSA-5mvj-wmgj-7q8c2024-04-16

  mlflow vulnerable to Path Traversal

• GHSA-f42m-mvfv-cgw52024-04-16

  mlflow vulnerable to Path Traversal

• GHSA-j62r-wxqq-f3gf2024-04-16

  mlflow vulnerable to Path Traversal

  Fixed in: 2.12.1

• GHSA-m49c-5c52-66962024-04-16

  mlflow vulnerable to Path Traversal

• GHSA-f82r-jj5r-6g972024-04-16

  mlflow Path Traversal vulnerability

  Fixed in: 2.12.1

• GHSA-3v79-q7ph-j75h2024-02-24

  MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution

  Fixed in: 2.10.0

• GHSA-6749-m5cp-6cg72024-02-24

  Cross-site Scripting in MLFlow

  Fixed in: 2.10.0

• GHSA-59v3-898r-qwhj2023-12-20

  MLflow Server-Side Request Forgery (SSRF)

  Fixed in: 2.9.2

• GHSA-5r3q-93q3-f9782023-12-20

  MLflow Path Traversal Vulnerability

  Fixed in: 2.9.2, 1da75dfcecd4d169e34809ade55748384e8af6c1

• GHSA-hh8p-p8mp-gqhm2023-12-20

  MLFlow Path Traversal Vulnerability

  Fixed in: 2.9.2

• GHSA-qg8p-32gr-gh6x2023-12-20

  MLflow Local File Disclosure Vulnerability

  Fixed in: 2.9.2

• GHSA-wv8q-4f85-2p8p2023-12-20

  MLflow Path Traversal Vulnerability

  Fixed in: 2.9.2

• GHSA-hvc6-42vf-jhf82023-12-19

  mlflow Command Injection vulnerability

  Fixed in: 2.9.2

• GHSA-554w-xh4j-8w642023-12-15

  Path traversal in MLflow

  Fixed in: 2.9.2, 1da75dfcecd4d169e34809ade55748384e8af6c1

• GHSA-v945-r3rc-6fjm2023-12-13

  Path traversal in MLflow

  Fixed in: 2.9.2, 1c6309f884798fbf56017a3cc808016869ee8de4

• GHSA-cxfr-5q3r-2rc22023-12-12

  Jinja2 template injection in mlflow

  Fixed in: 2.9.2, 432b8ccf27fd3a76df4ba79bb1bec62118a85625

• GHSA-vwhf-3v6x-wff82023-12-07

  Cross-site Scripting (XSS) in MLflow

  Fixed in: 2.9.0, 28ff3f94994941e038f2172c6484b65dc4db6ca1, 2.9.1

• GHSA-wqxf-447m-6f5f2023-12-05

  Information exposure in MLflow

  Fixed in: 2.9.0

• GHSA-4qq5-mxxx-m6gg2023-11-16

  MLflow authentication requirement bypass can allow a user to arbitrarily create an account

  Fixed in: 2.8.0

• GHSA-5p3h-7fwh-92rc2023-11-16

  Remote Code Execution due to Full Controled File Write in mlflow

  Fixed in: 2.9.2

• GHSA-f798-qm4r-23r52023-11-16

  MLflow allowed arbitrary files to be PUT onto the server

  Fixed in: 2.8.1

• GHSA-ffw3-6378-cqgp2023-08-01

  mlflow vulnerable to OS Command Injection

  Fixed in: 2.6.0, 6dde93758d42455cb90ef324407919ed67668b9b

• GHSA-fmxj-6h9g-6vw32023-07-19

  MLflow Path Traversal vulnerability

  Fixed in: 2.5.0, 6dde93758d42455cb90ef324407919ed67668b9b

• GHSA-wjq3-7jxx-whj92023-05-17

  mlflow Path Traversal vulnerability

  Fixed in: 2.3.0, fae77a525dd908c56d6204a4cef1c1c75b4e9857, 2.3.1

• GHSA-wc6j-5g83-xfm62023-05-11

  mflow vulnerable to directory traversal

  Fixed in: 2.0.0rc0, 2.0.1

• GHSA-83fm-w79m-64r52023-05-01

  Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

  Fixed in: 2.3.1

• GHSA-x422-6qhv-p29g2023-04-28

  Relative path traversal in mlflow

  Fixed in: 2.3.1, f73147496e05c09a8b83d95fb4f1bf86696c6342

• GHSA-wp72-7hj9-52652023-03-24

  Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

  Fixed in: 2.2.1, 63ef72aa4334a6473ce7f889573c92fcae0b3c0d, 2.2.2

• GHSA-xg73-94fp-g4492023-03-24

  mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs

  Fixed in: 2.2.1, 7162a50c654792c21f3e4a160eb1a0e6a34f6e6e

• GHSA-vqj2-4v8m-8vrq2022-02-24

  Insecure Temporary File in mlflow

  Fixed in: 1.23.1, 61984e6843d2e59235d82a580c529920cd8f3711