Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: mlflow/mlflow 3.10.0 Clear all filters
TI-2026-02230 CVE-2026-2614 · GHSA-42h5-h8qh-vv9v

Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow

Priority HIGH 72

A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's file…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.03626 Published 2026-05-11 Partial fix · 3.10.0 CWE-22
TI-2026-02027 CVE-2026-2393 · GHSA-65h7-c7c4-mghx

Server-Side Request Forgery (SSRF) in mlflow/mlflow

Priority MEDIUM 64

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0.

CVSS 3.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00288 Published 2026-05-11 Fixed in 3.10.0, 3.9.0 CWE-918