Advisories · Technology
MLflow.
Every CVE that names MLflow among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.2 High
MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability
- MLflow
- Server-side request forgery (SSRF)
- CVSS 7.8 High
MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability
- MLflow
- Insecure deserialization
- CVSS 5.4 Medium
MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability
- MLflow
- Broken access control
- CVSS 6.3 Medium
MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability
- MLflow
- Broken access control
- CVSS 5.4 Medium
MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability
- MLflow
- Broken access control
- CVSS 7.8 High
MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability
- MLflow
- Insecure deserialization
- CVSS 8.8 High
CVE-2026-96804
- MLflow
- Insecure deserialization
- CVSS 8.8 High
MLflow dspy bypasses pickle deserialization control
- MLflow
- Insecure deserialization
- CVSS 8.6 High
mlflow: Code execution can occur in versions of the MLflow platform running version 0.0.1 or…
- mlflow
- CWE-829
- CVSS 2.3 Low
MLflow Experiment-scoped Label Schema CRUD API authorization
- MLflow
- Broken access control