mlflow@3.10.1

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the Experiment-scoped Label Schema CRUD API due to missing authorization checks. An attacker can gain unauthorized access or manipulate data by sending crafted requests to the affected API endpoints. This is only exploitable if the deployment is configured within the OpenShift AI environment and the Experiment-scoped Label Schema CRUD API is exposed.

Upgrade mlflow to version 3.14.0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authorization via the _before_request handler in the trace API endpoints. An authenticated attacker can bypass access controls by sending trace read, search, delete, update, linking, or assessment requests for experiments they do not have permission to access. This lets the attacker read sensitive trace data, delete audit history, and modify traces or related assessments, breaking trace access isolation for users running MLflow with authentication enabled.

Notes

• Affected deployments are specifically those with MLflow authentication enabled; without that auth layer, the experiment-level authorization checks this bug bypasses are not applied.
• The gap covers both the stable and v3 trace routes, including parameterized trace subpaths such as trace tags, info, and assessment operations, not just the top-level list/read/delete endpoints.

Upgrade mlflow to version 3.13.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Direct Request ('Forced Browsing') in the Gateway API endpoints due to insufficient authorization checks. An attacker can access sensitive information, including secrets, endpoint configurations, and proprietary model definitions, by sending authenticated requests to the affected endpoints.

Note:

This is only exploitable if the deployment is configured with basic authentication, regardless of the user's specific permissions.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Use of Weak Hash in the mlflow.data.digest_utils function. An attacker can compromise data integrity or cause unexpected behavior by exploiting the use of a weak hash algorithm during dataset digest computation.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the api_key field in gateway secrets, which accepts environment variable references that are resolved against server-side credentials. An attacker can obtain sensitive environment credentials by configuring secrets to reference environment variables, causing these values to be sent to attacker-controlled endpoints in authentication headers.

Note:

This is only exploitable if the deployment is using basic-auth with low-privileged authenticated users or is a default deployment without basic-auth.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Origin Validation Error in the /ajax-api endpoints. An attacker can gain unauthorized access to the Assistant's configuration and execute arbitrary commands by sending crafted cross-origin requests from a malicious webpage.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions via the get_or_create_nfs_tmp_dir() and _create_model_downloading_tmp_dir() functions. An attacker can modify model artifacts by exploiting these permissions, potentially leading to arbitrary code execution when the tampered artifacts are deserialized. This is only exploitable if the environment uses shared NFS mounts with default configurations that allow local users to access these directories.

Note:

This issue is due to an incomplete fix for CVE-2025-10279.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via unsafe parsing of YAML-based MLmodel artifacts in the web interface. An attacker can execute arbitrary scripts in the context of another user's browser session by uploading a crafted MLmodel file containing malicious payloads, which are triggered when the artifact is viewed in the UI. This can lead to actions such as session hijacking or performing unauthorized operations on behalf of the victim.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Missing Authorization due to missing access-control validation in the AJAX endpoint used for downloading saved model artifacts. An attacker can gain unauthorized access to model artifacts by directly querying this endpoint without proper permissions.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere in the tracing and assessment endpoints. An attacker can access sensitive trace metadata and create unauthorized assessments by authenticating with any user account, even those with no permissions on the experiment.

Upgrade mlflow to version 3.11.0rc1 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Use of Default Credentials in the basic_auth.ini file. An attacker can gain unauthorized administrative access and execute arbitrary code if the default admin credentials have not been changed.

Note:

The patch in version 3.13.0rc0 does not modify the default behaviour of create_app but adds a user warning to allow user change the admin password early on.

Upgrade mlflow to version 3.13.0rc0 or higher.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the load function in the BaseCard class within the recipes/cards/__init__.py file. An attacker can execute arbitrary code on the target system by creating an MLProject Recipe containing a malicious pickle file (e.g. pickle.pkl) and a python script that calls BaseCard.load(pickle.pkl). The pickle file will be deserialized when the project is run.

Note:

If you are not running MLflow on a publicly accessible server, this vulnerability won't apply to you.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model function in the mlflow/pytorch/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') via the _run_entry_point function in the projects/backend/local.py file. An attacker can execute arbitrary code on the victim's system by submitting a maliciously crafted MLproject file.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_from_pickle function in the mlflow/langchain/utils.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_custom_objects function in the mlflow/tensorflow/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model function in the mlflow/lightgbm/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model function in the pmdarima/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.

mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the _load_model_from_local_file function in the sklearn/__init__.py file. An attacker can execute arbitrary code on the victim's system by injecting a malicious pickle object into a PyFunc model, which will then be deserialized when the model is loaded.

There is no fixed version for mlflow.