High
CVE-2026-71211
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 84
Reset filters
High
ghsa-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
Critical
Exploited in attacks
CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
High
CVE-2026-4137
MLFlow Creates a Temporary File With Insecure Permissions
High
CVE-2025-15381
MLFlow allows Tracing + Assessments Access
High
CVE-2025-15031
Arbitrary file write via tar traversal in mlflow
High
CVE-2025-14287
MLflow has a command injection in mlflow/sagemaker/__init__.py
High
CVE-2026-2033
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
High
CVE-2025-10279
mlflow Creates of Temporary File in Directory with Insecure Permissions
High
CVE-2025-14279
MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
High
CVE-2026-22607
Fickling Blocklist Bypass: cProfile.run()
High
CVE-2024-37061
MLFlow improper input validation
High
CVE-2024-37059
MLFlow unsafe deserialization
High
CVE-2026-8147
MLflow: trace API endpoints lack proper authorization validators
Critical
CVE-2026-2635
MLflow Use of Default Password Authentication Bypass Vulnerability
Critical
CVE-2026-2611
MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
Critical
CVE-2026-0545
mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization
Critical
CVE-2025-15036
MLFlow path traversal vulnerability
Critical
CVE-2025-15379
MLflow Command Injection vulnerability
Low
CVE-2026-10803
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipul
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environme
Medium
CVE-2026-3198
MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
Critical
CVE-2026-2651
MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled
Medium
CVE-2026-2734
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.