MLflow vulnerabilities and CVEs
The Beam CVE database tracks 84 security advisories for MLflow: 23 critical, 46 high, 13 medium and 2 low severity. 1 is known to be exploited (CISA KEV). The newest is CVE-2026-115886, published Oct 23, 2026 and fixed in 3.17.0.
An open-source platform for tracking, evaluating and serving models and GenAI apps, including an AI gateway.
Check your version: pip show mlflow
- Vulnerabilities tracked
- 84
- Critical
- 23
- Known exploited (CISA KEV)
- 1
- Published in the last 30 days
- 2
All entries, newest first
CVE-2026-115886
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
medium6.5Oct 23, 2026CVE-2026-53995
MLflow FileStore trace IDs allow path traversal and arbitrary file writes
high8.2Oct 20, 2026GHSA-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
high8.8Sep 1, 2026CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
critical9.3ExploitedAug 17, 2026CVE-2026-71211
MLflow AI Gateway permits SSRF through an unvalidated api_base
high7.1No fixAug 5, 2026CVE-2026-8147
MLflow: trace API endpoints lack proper authorization validators
high8.1Jul 2, 2026CVE-2026-10803
MLflow: Deterministic sampling in dataset digest enables predictable collisions
low3.6Jun 4, 2026CVE-2026-4035
MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
critical9.1Jun 3, 2026CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
medium6.5Jun 2, 2026CVE-2026-2651
MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled
critical9.0May 26, 2026CVE-2026-2734
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
medium6.5May 21, 2026CVE-2026-2611
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
critical9.6May 19, 2026CVE-2026-4137
MLFlow Creates a Temporary File With Insecure Permissions
high7.0May 18, 2026CVE-2026-2652
MLflow: unauthenticated access to certain FastAPI routes
high8.6May 15, 2026CVE-2026-2393
MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
high7.1May 11, 2026CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
high7.5May 11, 2026CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
medium5.4Apr 7, 2026CVE-2026-33866
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
medium4.3Apr 7, 2026CVE-2026-0545
mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization
critical9.1No fixApr 3, 2026CVE-2026-0596
Mlflow: Command Injection when serving models with enable_mlserver=True
critical9.6Mar 31, 2026CVE-2025-15036
MLFlow path traversal vulnerability
critical9.6Mar 30, 2026CVE-2025-15379
MLflow Command Injection vulnerability
critical10.0Mar 30, 2026CVE-2025-15381
MLFlow allows Tracing + Assessments Access
high8.1No fixMar 27, 2026CVE-2025-15031
Arbitrary file write via tar traversal in mlflow
high8.1Mar 19, 2026CVE-2025-14287
MLflow has a command injection in mlflow/sagemaker/__init__.py
high7.5Mar 16, 2026CVE-2026-2033
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
high8.1Feb 21, 2026CVE-2026-2635
MLflow Use of Default Password Authentication Bypass Vulnerability
critical9.8Feb 21, 2026CVE-2025-10279
mlflow Creates of Temporary File in Directory with Insecure Permissions
high7.0Feb 2, 2026CVE-2025-14279
MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
high8.1Jan 12, 2026CVE-2025-11200
MLflow Weak Password Requirements Authentication Bypass Vulnerability
high8.1Oct 29, 2025CVE-2025-11201
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
high8.1Oct 29, 2025CVE-2025-52967
MLFlow SSRF via gateway_proxy_handler
medium5.8Jun 23, 2025CVE-2024-6838
MLflow Uncontrolled Resource Consumption vulnerability
medium5.3No fixMar 20, 2025CVE-2024-8859
MLflow has a Local File Read/Path Traversal in dbfs
high7.5Mar 20, 2025CVE-2025-0453
MLflow Uncontrolled Resource Consumption vulnerability
medium5.9No fixMar 20, 2025CVE-2025-1473
MLflow Cross-Site Request Forgery (CSRF) vulnerability
medium5.4Mar 20, 2025CVE-2025-1474
MLflow has Weak Password Requirements
low3.8Mar 20, 2025CVE-2024-27134
MLflow's excessive directory permissions allow local privilege escalation
high7.0Nov 25, 2024CVE-2024-0520
Remote code execution in mlflow
critical10.0Jun 6, 2024CVE-2024-2928
Local File Inclusion in mlflow
high7.5Jun 6, 2024CVE-2024-3099
Undefined Behavior in mlflow
medium5.4Jun 6, 2024CVE-2024-37052
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37053
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37054
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37055
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37056
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37057
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37058
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37059
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37060
MLFlow unsafe deserialization
high8.8No fixJun 4, 2024CVE-2024-37061
MLFlow improper input validation
high8.8No fixJun 4, 2024CVE-2024-3848
MLflow has a Local File Read/Path Traversal bypass
high7.5May 16, 2024CVE-2024-4263
MLflow allows low privilege users to delete any artifact
medium5.4May 16, 2024CVE-2024-1483
mlflow Path Traversal vulnerability
high7.5Apr 16, 2024CVE-2024-1558
mlflow vulnerable to Path Traversal
high7.5Apr 16, 2024CVE-2024-1560
mlflow vulnerable to Path Traversal
high8.1No fixApr 16, 2024CVE-2024-1593
mlflow vulnerable to Path Traversal
high7.5No fixApr 16, 2024CVE-2024-1594
mlflow vulnerable to Path Traversal
high7.5No fixApr 16, 2024CVE-2024-3573
mlflow vulnerable to Path Traversal
critical9.3Apr 16, 2024CVE-2024-27132
Cross-site Scripting in MLFlow
critical9.6Feb 24, 2024CVE-2024-27133
MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution
critical9.6Feb 24, 2024CVE-2023-6909
MLflow Path Traversal Vulnerability
high7.5Dec 20, 2023CVE-2023-6974
MLflow Server-Side Request Forgery (SSRF)
critical9.8Dec 20, 2023CVE-2023-6975
MLFlow Path Traversal Vulnerability
critical9.8Dec 20, 2023CVE-2023-6976
MLflow Path Traversal Vulnerability
high8.8Dec 20, 2023CVE-2023-6977
MLflow Local File Disclosure Vulnerability
high7.5Dec 20, 2023CVE-2023-6940
mlflow Command Injection vulnerability
high8.8Dec 19, 2023CVE-2023-6831
Path traversal in MLflow
critical10.0Dec 15, 2023CVE-2023-6753
Path traversal in MLflow
high8.8Dec 13, 2023CVE-2023-6709
Jinja2 template injection in mlflow
high8.8Dec 12, 2023CVE-2023-6568
Cross-site Scripting (XSS) in MLflow
medium6.5Dec 7, 2023CVE-2023-43472
Information exposure in MLflow
high7.5Dec 5, 2023CVE-2023-6014
MLflow authentication requirement bypass can allow a user to arbitrarily create an account
critical9.1Nov 16, 2023CVE-2023-6015
MLflow allowed arbitrary files to be PUT onto the server
critical10.0Nov 16, 2023CVE-2023-6018
Remote Code Execution due to Full Controled File Write in mlflow
critical10.0Nov 16, 2023CVE-2023-4033
mlflow vulnerable to OS Command Injection
high8.8Aug 1, 2023CVE-2023-3765
MLflow Path Traversal vulnerability
critical10.0Jul 19, 2023CVE-2023-2780
mlflow Path Traversal vulnerability
critical9.8May 17, 2023CVE-2023-30172
mflow vulnerable to directory traversal
high7.5May 11, 2023GHSA-83fm-w79m-64r5
Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
criticalMay 1, 2023CVE-2023-2356
Relative path traversal in mlflow
high10.0Apr 28, 2023CVE-2023-1176
Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs
medium3.3Mar 24, 2023CVE-2023-1177
mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs
critical9.8Mar 24, 2023CVE-2022-0736
Insecure Temporary File in mlflow
high8.2Feb 24, 2022