Mlflow vulnerabilities
We track 57 vulnerabilities in Mlflow products across 2 products. 57 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on November 4, 2026.
Latest Mlflow vulnerabilities
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
- 8.8 High severity
MLflow: Deserialization of Untrusted Data
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
- 7.5 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a p
- 9.3 Critical severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empt
- 7.5 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component `#` in the artifact
- 7.5 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using the ';' character in URLs, attackers can manipulate the 'params' portion of the URL to gain unauthoriz
- 8.1 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the `_delete_artifact_mlflow_artifacts` handler an
- 7.5 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflow/mlflow repository, due to improper validation of the `source` parameter. Attackers can exploit this vulnerability by crafting a `source` p
- 7.5 High severity
mlflow/mlflow: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI w
- 9.8 Critical severity
mlflow/mlflow: Server-Side Request Forgery
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.