Iniciar sesión
Deutsch English Español Polski
Media

MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions

  • Publicada: 02.06.2026
  • Actualizado: 11.10.2026 14:17

MLflow 3.9.0 with basic-auth (--app-name basic-auth) fails to enforce authorization checks for multiple Gateway API 'list' endpoints. Specifically, the BEFORE_REQUEST_HANDLERS dictionary in mlflow/server/auth/__init__.py does not include entries for ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions. This allows any authenticated user, regardless of their assigned permissions, to enumerate all gateway secrets, endpoints, and model definitions. This vulnerability exposes sensitive information, such as API keys, endpoint configurations, and proprietary model definitions, to unauthorized users.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) mlflow < 3.11.0rc0 3.11.0rc0

Referencias

Puntuación CVSS 6.5/10
Vector CVSS
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Debilidad (CWE)
CWE-284
Plataforma
Python (PyPI)
Paquete
mlflow
Publicada
02.06.2026
Actualizado
11.10.2026 14:17

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-r5m9-wm49-959f - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-2659 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: mlflow

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (82) en el archivo
Entradas en total
82
Primera → última
02.2022 09.2026
Sin corrección
18
Explotada en ataques
1

Distribución por gravedad

  • Crítica 20
  • Alta 48
  • Media 13
  • Baja 1

Divulgaciones por año

Gravedad:
  1. MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
    Alta · 8.8 ghsa-gqvg-gmmx-x4hm >= 2.1.0, < 3.15.0 3.15.0
  2. MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
    Crítica · 9.3 Explotada en ataques CVE-2026-64849 >= 3.3.0, < 3.15.0 3.15.0
  3. MLflow AI Gateway permits SSRF through an unvalidated api_base
    Alta · 7.1 CVE-2026-71211 >= 3.13.0, <= 3.15.2 sin corrección
  4. MLflow: trace API endpoints lack proper authorization validators
    Alta · 8.1 CVE-2026-8147 >= 2.14.0rc0, < 3.13.0rc0 3.13.0rc0
  5. A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
    Alta · 7.7 CVE-2026-4035 < 3.11.0 3.11.0
  6. MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions esta entrada
    Media · 6.5 CVE-2026-3198 < 3.11.0rc0 3.11.0rc0
  7. MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled
    Crítica · 9.0 CVE-2026-2651 < 3.10.0 3.10.0
  8. MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
    Crítica · 9.6 CVE-2026-2611 >= 3.9.0, < 3.10.0 3.10.0
  9. MLFlow Creates a Temporary File With Insecure Permissions
    Alta · 7.0 CVE-2026-4137 >= 1.26.0, < 3.11.0 3.11.0
  10. A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and
    Alta · 8.6 CVE-2026-2652 < 3.10.0 3.10.0
  11. MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
    Alta · 7.5 CVE-2026-2614 < 3.10.0 3.10.0
  12. A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function in `mlflow/server/handlers.py` accepts a user-controlled `url` parameter w
    Alta · 7.1 CVE-2026-2393 < 3.9.0 3.9.0
  13. mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization
    Crítica · 9.1 CVE-2026-0545 <= 3.10.1 sin corrección
  14. Mlflow: Command Injection when serving models with enable_mlserver=True
    Crítica · 9.6 CVE-2026-0596 < 3.9.0 3.9.0
  15. MLflow Command Injection vulnerability
    Crítica · 10.0 CVE-2025-15379 < 3.8.1 3.8.1
  16. MLFlow path traversal vulnerability
    Crítica · 9.6 CVE-2025-15036 < 3.9.0rc0 3.9.0rc0
  17. MLFlow allows Tracing + Assessments Access
    Alta · 8.1 CVE-2025-15381 <= 3.8.1 sin corrección
  18. Arbitrary file write via tar traversal in mlflow
    Alta · 8.1 CVE-2025-15031 < 3.9.0rc0 3.9.0rc0
  19. MLflow has a command injection in mlflow/sagemaker/__init__.py
    Alta · 7.5 CVE-2025-14287 < 3.8.0rc0 3.8.0rc0
  20. MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
    Alta · 8.1 CVE-2026-2033 < 3.8.0rc0 3.8.0rc0
  21. MLflow Use of Default Password Authentication Bypass Vulnerability
    Crítica · 9.8 CVE-2026-2635 < 3.8.0rc0 3.8.0rc0
  22. mlflow Creates of Temporary File in Directory with Insecure Permissions
    Alta · 7.0 CVE-2025-10279 < 3.4.0rc0 3.4.0rc0
  23. MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
    Alta · 8.1 CVE-2025-14279 < 3.5.0 3.5.0
  24. MLflow Weak Password Requirements Authentication Bypass Vulnerability
    Alta · 8.1 CVE-2025-11200 < 2.22.0rc0 2.22.0rc0
  25. MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
    Alta · 8.1 CVE-2025-11201 < 2.22.4, >= 3.0.0rc0, < 3.0.0 2.22.4, 3.0.0
  26. MLflow has a Local File Read/Path Traversal in dbfs
    Alta · 7.5 CVE-2024-8859 < 2.17.0rc0 2.17.0rc0
  27. Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU at
    Alta · 7.0 CVE-2024-27134 < 2.16.0 2.16.0
  28. A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure t
    Alta · 7.5 CVE-2024-2928 < 2.11.3 2.11.3
  29. A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.h
    Alta · 8.8 CVE-2024-0520 < 2.9.0 2.9.0
  30. MLFlow improper input validation
    Alta · 8.8 CVE-2024-37061 >= 1.11.0, <= 2.13.1 sin corrección
  31. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37057 >= 2.0.0rc0, <= 2.14.1 sin corrección
  32. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37058 >= 2.5.0, <= 2.14.1 sin corrección
  33. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37060 >= 1.27.0, <= 2.14.1 sin corrección
  34. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37059 >= 0.5.0, <= 3.4.0 sin corrección
  35. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37054 >= 0.9.0, <= 2.14.1 sin corrección
  36. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37052 >= 1.1.0, <= 2.14.1 sin corrección
  37. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37055 >= 1.24.0, <= 2.14.1 sin corrección
  38. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37056 >= 1.23.0, <= 2.14.1 sin corrección
  39. MLFlow unsafe deserialization
    Alta · 8.8 CVE-2024-37053 >= 1.1.0, <= 2.14.1 sin corrección
  40. A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of ar
    Alta · 7.5 CVE-2024-3848 < 2.12.1 2.12.1
  41. mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_loc
    Crítica · 9.3 CVE-2024-3573 < 2.10.0 2.10.0
  42. mlflow vulnerable to Path Traversal
    Alta · 8.1 CVE-2024-1560 <= 2.9.2 sin corrección
  43. mlflow vulnerable to Path Traversal
    Alta · 7.5 CVE-2024-1594 <= 2.9.2 sin corrección
  44. mlflow vulnerable to Path Traversal
    Alta · 7.5 CVE-2024-1593 <= 2.9.2 sin corrección
  45. mlflow vulnerable to Path Traversal
    Alta · 7.5 CVE-2024-1558 < 2.12.1 2.12.1
  46. mlflow Path Traversal vulnerability
    Alta · 7.5 CVE-2024-1483 < 2.12.1 2.12.1
  47. Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerabil
    Crítica · 9.6 CVE-2024-27133 < 2.10.0 2.10.0
  48. Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.
    Crítica · 9.6 CVE-2024-27132 < 2.10.0 2.10.0
  49. MLflow Path Traversal Vulnerability
    Alta · 8.8 CVE-2023-6976 < 2.9.2 2.9.2
  50. MLflow Local File Disclosure Vulnerability
    Alta · 7.5 CVE-2023-6977 < 2.9.2 2.9.2
  51. MLflow Server-Side Request Forgery (SSRF)
    Crítica · 9.8 CVE-2023-6974 < 2.9.2 2.9.2
  52. MLFlow Path Traversal Vulnerability
    Crítica · 9.8 CVE-2023-6975 < 2.9.2 2.9.2
  53. mlflow Command Injection vulnerability
    Alta · 8.8 CVE-2023-6940 < 2.9.2 2.9.2
  54. Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
    Alta · 7.5 CVE-2023-6909 < 2.9.2 2.9.2
  55. Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
    Alta · 8.1 CVE-2023-6831 < 2.9.2 2.9.2
  56. Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.
    Alta · 8.8 CVE-2023-6753 < 2.9.2 2.9.2
  57. Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository mlflow/mlflow prior to 2.9.2.
    Alta · 8.8 CVE-2023-6709 < 2.9.2 2.9.2
  58. Information exposure in MLflow
    Alta · 7.5 CVE-2023-43472 < 2.9.0 2.9.0
  59. MLflow authentication requirement bypass can allow a user to arbitrarily create an account
    Crítica · 9.1 CVE-2023-6014 < 2.8.0 2.8.0
  60. MLflow allowed arbitrary files to be PUT onto the server
    Crítica · 10.0 CVE-2023-6015 < 2.8.1 2.8.1
  61. Remote Code Execution due to Full Controled File Write in mlflow
    Crítica · 10.0 CVE-2023-6018 < 2.9.2 2.9.2
  62. OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.
    Alta · 7.8 CVE-2023-4033 < 2.6.0 2.6.0
  63. Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
    Crítica · 10.0 CVE-2023-3765 < 2.5.0 2.5.0
  64. Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
    Crítica · 9.8 CVE-2023-2780 < 2.3.1 2.3.1
  65. A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary files on the server via the path parameter.
    Alta · 7.5 CVE-2023-30172 < 2.0.1 2.0.1
  66. Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
    Crítica ghsa-83fm-w79m-64r5 < 2.3.1 2.3.1
  67. Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
    Alta · 10.0 CVE-2023-2356 < 2.3.1 2.3.1
  68. Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
    Crítica · 9.8 CVE-2023-1177 < 2.2.1 2.2.1
  69. Insecure Temporary File in mlflow
    Alta · 8.2 CVE-2022-0736 < 1.23.1 1.23.1

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.