mlflow@2.13.3

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Unsafe Dependency Resolution through the model artifact loading process in the project’s model handling components. An attacker can execute code on an end user’s system by supplying a maliciously crafted model artifact that MLflow loads. When the project loads the artifact, the attacker’s payload runs in the context of the user or service loading the model, putting the affected system and any accessible data at risk.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the _load_model() and _load_pyfunc() functions of the mlflow.statsmodels flavor (mlflow/statsmodels/__init__.py), which call statsmodels.iolib.api.load_pickle() without honoring the MLFLOW_ALLOW_PICKLE_DESERIALIZATION control that guards the other flavors. An attacker can achieve arbitrary code execution by placing a malicious pickle file alongside an MLmodel artifact that declares the statsmodels flavor in an accessible artifact store, which executes when a victim calls mlflow.pyfunc.load_model() on it. This requires the attacker to write the artifact into a store the victim loads from, and the victim to load that specific model.

Upgrade mlflow to version 3.15.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authorization via the LogInputs and LogOutputs endpoints, which lack update-run authorization enforcement. An authenticated attacker can log arbitrary inputs and outputs to any run without possessing the required update-run permission, allowing unauthorized modification of run data.

Upgrade mlflow to version 3.15.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authorization via the CreateModelVersion endpoint, which previously only required UPDATE permission on the destination registered model without verifying READ permission on the source run or model. An authenticated attacker can point the source field of a new model version at another user's run or model artifact directory, then read those artifacts through their own registered model, bypassing artifact-read access controls on the source resource.

Upgrade mlflow to version 3.15.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via a DNS rebinding attack against the webhook delivery mechanism in mlflow/webhooks/delivery.py. The original SSRF protection in _validate_webhook_url resolves the webhook hostname and checks that all resolved IPs are public, but then discards the resolved address; the subsequent requests.post call re-resolves the hostname independently. This TOCTOU gap allows an attacker to return a public IP during validation and a private or link-local IP (e.g., 169.254.169.254) at actual request time, enabling unauthenticated access to cloud metadata services or internal network resources. No authentication or user interaction is required.

Upgrade mlflow to version 3.15.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via the raw_proxy. An attacker can access internal network resources and potentially retrieve sensitive information by supplying a crafted api_base value when creating a gateway secret and then issuing requests through the gateway proxy endpoint.

**Note:** This is only exploitable if an authenticated user is able to create a gateway secret with an internal address as the api_base`.

Upgrade mlflow to version 3.14.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Experiment-scoped Label Schema CRUD API due to missing authorization checks. An attacker can gain unauthorized access or manipulate data by sending crafted requests to the affected API endpoints. This is only exploitable if the deployment is configured within the OpenShift AI environment and the Experiment-scoped Label Schema CRUD API is exposed.

Upgrade mlflow to version 3.14.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authorization via the _before_request handler in the trace API endpoints. An authenticated attacker can bypass access controls by sending trace read, search, delete, update, linking, or assessment requests for experiments they do not have permission to access. This lets the attacker read sensitive trace data, delete audit history, and modify traces or related assessments, breaking trace access isolation for users running MLflow with authentication enabled.

Notes

• Affected deployments are specifically those with MLflow authentication enabled; without that auth layer, the experiment-level authorization checks this bug bypasses are not applied.
• The gap covers both the stable and v3 trace routes, including parameterized trace subpaths such as trace tags, info, and assessment operations, not just the top-level list/read/delete endpoints.

Upgrade mlflow to version 3.13.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Direct Request ('Forced Browsing') in the Gateway API endpoints due to insufficient authorization checks. An attacker can access sensitive information, including secrets, endpoint configurations, and proprietary model definitions, by sending authenticated requests to the affected endpoints.

Note:

This is only exploitable if the deployment is configured with basic authentication, regardless of the user's specific permissions.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Use of Weak Hash in the mlflow.data.digest_utils function. An attacker can compromise data integrity or cause unexpected behavior by exploiting the use of a weak hash algorithm during dataset digest computation.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the api_key field in gateway secrets, which accepts environment variable references that are resolved against server-side credentials. An attacker can obtain sensitive environment credentials by configuring secrets to reference environment variables, causing these values to be sent to attacker-controlled endpoints in authentication headers.

Note:

This is only exploitable if the deployment is using basic-auth with low-privileged authenticated users or is a default deployment without basic-auth.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authorization in the /mlflow-artifacts/mpu/* endpoints in --serve-artifacts mode. An attacker can gain unauthorized access to and overwrite artifacts belonging to other users by manipulating artifact_path and path(filename) arguments. This may result in cross-user data modification, model supply chain compromise, and arbitrary code execution when affected models are loaded.

Upgrade mlflow to version 3.10.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Access Control Bypass via the SearchModelVersions REST API endpoint and the mlflowSearchModelVersions GraphQL query. An attacker can access sensitive information, including model names, version descriptions, source URIs, tags, and other metadata, by sending authenticated requests that bypass intended authorization checks.

Note:

This is only exploitable if basic authentication is enabled and per-model authorization is expected in a multi-tenant environment.

Upgrade mlflow to version 3.10.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions via the get_or_create_nfs_tmp_dir() and _create_model_downloading_tmp_dir() functions. An attacker can modify model artifacts by exploiting these permissions, potentially leading to arbitrary code execution when the tampered artifacts are deserialized. This is only exploitable if the environment uses shared NFS mounts with default configurations that allow local users to access these directories.

Note:

This issue is due to an incomplete fix for CVE-2025-10279.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the _find_fastapi_validator function. An attacker can gain unauthorized access to sensitive API endpoints by sending requests to non-/gateway/ paths when the server is started with authentication enabled and served via uvicorn. This allows actions such as submitting jobs, reading job results, canceling running jobs, and injecting arbitrary trace data without authentication.

Note:

This is only exploitable if the server is started with the --app-name basic-auth flag and served via uvicorn (ASGI).

Upgrade mlflow to version 3.10.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Directory Traversal via the _create_model_version function. An attacker can access arbitrary files on the server's filesystem by including the mlflow.prompt.is_prompt tag in a CreateModelVersion request, which bypasses source path validation and allows storage of arbitrary local filesystem paths as the model version source. The get_model_version_artifact_handler function subsequently serves files from these paths without verifying the prompt status, enabling unauthorized disclosure of sensitive information.

Upgrade mlflow to version 3.10.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in _validate_webhook_url(), in validate.py. The _create_webhook function accepts a user-controlled url parameter without validation. An attacker can cause the backend to send HTTP requests to internal services, cloud metadata endpoints, or arbitrary external servers.

Upgrade mlflow to version 3.10.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via unsafe parsing of YAML-based MLmodel artifacts in the web interface. An attacker can execute arbitrary scripts in the context of another user's browser session by uploading a crafted MLmodel file containing malicious payloads, which are triggered when the artifact is viewed in the UI. This can lead to actions such as session hijacking or performing unauthorized operations on behalf of the victim.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authorization due to missing access-control validation in the AJAX endpoint used for downloading saved model artifacts. An attacker can gain unauthorized access to model artifacts by directly querying this endpoint without proper permissions.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the FastAPI endpoints under /ajax-api/3.0/jobs/* when the basic-auth app is enabled. An attacker can gain unauthorized access to submit, read, search, and cancel jobs by sending network requests without credentials, potentially leading to remote code execution, data exposure, or denial of service.

Note:

This is only exploitable if job execution is enabled (MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true) and at least one job function is allowlisted.

Upgrade mlflow to version 3.10.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Command Injection when serving models with enable_mlserver=True due to unsanitized input being embedded into a shell command. An attacker can execute arbitrary commands by supplying specially crafted model URIs containing shell metacharacters.

Upgrade mlflow to version 3.9.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in the tracing and assessment endpoints. An attacker can access sensitive trace metadata and create unauthorized assessments by authenticating with any user account, even those with no permissions on the experiment.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Arbitrary Command Injection in the _install_model_dependencies_to_env function. An attacker can execute arbitrary commands by supplying a crafted model artifact containing malicious dependency specifications in the python_env.yaml file, which are unsafely interpolated into a shell command during model deployment with env_manager=LOCAL.

Note: The vulnerable path is reached during model deployment, where MLflow reads dependency entries from the model artifact and installs them in the local environment.

Upgrade mlflow to version 2.22.5, 3.8.1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the extract_archive_to_dir function. An attacker can overwrite arbitrary files or gain elevated privileges by supplying a crafted tar.gz file containing malicious paths during extraction. This may allow escape from the intended sandbox directory in multi-tenant or shared cluster environments.

Upgrade mlflow to version 3.9.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Directory Traversal in the extraction process of tar archives due to improper validation of archive entry paths. An attacker can overwrite arbitrary files on the filesystem by supplying a crafted tar.gz file containing directory traversal sequences or absolute paths.

Upgrade mlflow to version 3.9.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Command Injection via the --container parameter. An attacker can execute unauthorized commands by supplying specially crafted input that is not properly sanitized.

Note:

This is only exploitable if the attacker has shell access to the system.

Upgrade mlflow to version 3.8.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Directory Traversal via the '_find_run_rootfunction in theFileStoretracking component. An attacker can access arbitrary files on the server by planting a maliciousmeta.yaml` in an artifact folder to redirect artifact URI resolution to sensitive directories.

Upgrade mlflow to version 3.8.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Use of Default Credentials in the basic_auth.ini file. An attacker can gain unauthorized administrative access and execute arbitrary code if the default admin credentials have not been changed.

Note:

The patch in version 3.13.0rc0 does not modify the default behaviour of create_app but adds a user warning to allow user change the admin password early on.

Upgrade mlflow to version 3.13.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions in the get_or_create_tmp_dir() function in file_utils.py. This enables an attacker who can write to /tmp to cause the execution of arbitrary .py files during environment setup.

Upgrade mlflow to version 3.4.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Origin Validation Error in the REST server, accessible via the experiments/search endpoint. An attacker can access, modify, or delete sensitive experiment data by tricking a user into visiting a malicious website that issues unauthorized requests to REST endpoints.

Upgrade mlflow to version 3.5.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Symlink Attack due to insufficient validation that artifact paths (after following symlinks) remain inside the configured local artifact directory. An attacker can create an artifact that is a symbolic link pointing to a file outside of the designated artifact repository.

Upgrade mlflow to version 3.8.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to SQL Injection due to unsafe construction of SQL statements in the get_execute_function_sql_stmt function within mlflow/gateway/uc_function_utils.py. An attacker can execute arbitrary SQL statements by providing a maliciously crafted Unity Catalog function name or parameter name that is directly interpolated into the SQL query without proper quoting or escaping.

Note: Because function names should not be susceptible to attacker influence, exploitation is unlikely; however, the maintainer considered exploitation possible; see comment

Upgrade mlflow to version 3.8.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Directory Traversal via improper validation of user-supplied paths in the model file paths. An attacker can execute arbitrary code in the context of the service account by supplying crafted path input to perform unauthorized file operations.

Upgrade mlflow to version 3.0.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Weak Password Requirements due to allowing password strings shorter than 12 characters. An attacker can gain unauthorized access by supplying weak credentials that bypass standard security checks.

Upgrade mlflow to version 2.22.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) via insufficient validation of the gateway_path parameter in the gateway_proxy_handler process. An attacker can interact with unintended internal resources by supplying crafted input to bypass access controls.

Upgrade mlflow to version 3.0.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Input Length Validation in the experiment_name - passed to the run_name() function - and artifact_location parameters. An attacker can cause the UI panel to become unresponsive by passing in an experiment name including a large number of integers.

Upgrade mlflow to version 2.21.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in handlers.py, which is exploitable over the /graphql endpoint. An attacker can occupy all available workers and make the server unresponsive to other connections by sending large batches of GraphQL queries that repeatedly request all runs from a given experiment and stay in a pending state. Experiments configured to have a large number of runs are vulnerable.

Upgrade mlflow to version 3.1.1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Weak Password Requirements due to the lack of enforcement on password creation during new user account setup. An attacker can gain unauthorized access to the system by exploiting accounts created without passwords.

Upgrade mlflow to version 2.19.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) through the Signup feature. An attacker can create a new account, which may be used to perform unauthorized actions on behalf of the malicious user.

Note:

If targeting the attack at an administrative user, the attacker can create a new user that will have access to sensitive data & functionality within MLflow.

Upgrade mlflow to version 2.20.2 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Relative Path Traversal in the _validate_non_local_source_contains_relative_paths() function. An application is vulnerable when the dbfs service is configured and mounted to a local directory rather than Databricks. An attacker can read arbitrary files by manipulating the URL used in the file: protocol, which fails to properly sanitize input beyond the path, such as query and parameters.

Upgrade mlflow to version 2.17.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition due to excessive directory permissions when the spark_udf() MLflow API is called. An attacker can gain elevated permissions by exploiting this vulnerability.

Upgrade mlflow to version 2.16.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Arbitrary Code Injection due to the autologin method that allows injection of the MLflow callback into the user's callback list. This can lead to failures of predict_stream, ainvoke, astream, and abatch calls when configurations are specified.

Upgrade mlflow to version 2.15.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the load function in the BaseCard class within the recipes/cards/__init__.py file. An attacker can execute arbitrary code on the target system by creating an MLProject Recipe containing a malicious pickle file (e.g. pickle.pkl) and a python script that calls BaseCard.load(pickle.pkl). The pickle file will be deserialized when the project is run.

Note:

If you are not running MLflow on a publicly accessible server, this vulnerability won't apply to you.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model function in the mlflow/pytorch/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the _run_entry_point function in the projects/backend/local.py file. An attacker can execute arbitrary code on the victim's system by submitting a maliciously crafted MLproject file.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_from_pickle function in the mlflow/langchain/utils.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_custom_objects function in the mlflow/tensorflow/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model function in the mlflow/lightgbm/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model function in the pmdarima/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model_from_local_file function in the sklearn/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model, which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.