TI-2025-14028 Aliases CVE-2025-15379 GHSA-r23q-823p-vmf7

Command Injection in mlflow/mlflow

HIGH 82CWE-77Published 2026-03-30 · Updated 2026-09-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-77.

Summary

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.02401 84th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial mlflow/mlflow (mlflow): 3.8.2mlflow (PyPI): 3.8.1Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MLflow	mlflow/mlflow	before 3.8.2	3.8.2	Patch available	CNA
—	mlflow (PyPI)	before 3.8.1	3.8.1	Patch available	GHSA-r23q-823p-vmf7

mlflow/mlflow VendorMLflow Affected before 3.8.2 Fixed in 3.8.2 Patch available CNA
mlflow (PyPI) Vendor— Affected before 3.8.1 Fixed in 3.8.1 Patch available GHSA-r23q-823p-vmf7

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lfprojects:mlflow::::::::	3.8.0 to before 3.8.1	Vulnerable	MLflow

cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* Versions 3.8.0 to before 3.8.1 Vulnerable ·MLflow

Remediation

Fix · CNA mlflow/mlflow (mlflow) Fixed in 3.8.2
Fix · GHSA-r23q-823p-vmf7 mlflow (PyPI) Fixed in 3.8.1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift AI (RHOAI)	Affected	No fix yet

Not affected: 1 product

Red Hat OpenShift AI (RHOAI)

Timeline

2026-10-02 Threatist record created from CVE-2025-15379
2026-10-03 Alias added: GHSA-r23q-823p-vmf7

References

Exploit 1

https://huntr.com/bounties/dc9c1c20-7879-4050-87df-4d095fe5ca75

Patch 1

https://github.com/mlflow/mlflow/commit/361b6f620adf98385c6721e384fb5ef9a30bb05e

Advisory 4

Other 2

TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2023-02603 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
TI-2026-00348 Missing Authentication for Critical Function in mlflow/mlflow CVSS 3.1CRITICAL 9.8

See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences