Mlflow

This hub aggregates every CVE we track for Mlflow, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting Mlflow.

• CVE-2026-96804CVE-2026-968048.8Sep 23, 2026
• CVE-2026-96775MLflow dspy bypasses pickle deserialization control8.8Sep 23, 2026
• CVE-2026-79721Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when load...Sep 8, 2026
• GHSA-gqvg-gmmx-x4hmMLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifactSep 1, 2026
• CVE-2026-69146MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth6.5Aug 17, 2026
• CVE-2026-69148MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id7.1Aug 17, 2026
• CVE-2026-64849MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)KEV9.3Aug 17, 2026
• CVE-2026-71211mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint7.1Aug 5, 2026
• CVE-2026-8147Authorization Bypass in mlflow/mlflow8.1Jul 2, 2026
• CVE-2026-13484MLflow Experiment-scoped Label Schema CRUD API authorization5.0Jun 28, 2026
• CVE-2026-10803MLflow Dataset Digest Computation digest_utils.py mlflow.data.digest_utils weak hash3.6Jun 4, 2026
• CVE-2026-4035Environment Variable Resolution Vulnerability in mlflow/mlflow7.7Jun 3, 2026
• CVE-2026-3198Improper Access Control in mlflow/mlflow6.5Jun 2, 2026
• CVE-2026-2651Missing Authorization Validation in mlflow/mlflow9.0May 25, 2026
• CVE-2026-2734Authorization Bypass in SearchModelVersions in mlflow/mlflow6.5May 21, 2026