Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

mlflow — Vulnerabilities & Security Advisories 78

Browse all 78 CVE security advisories affecting mlflow. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MLflow is an open-source platform designed for the machine learning lifecycle, facilitating experiment tracking, reproducibility, and deployment. Despite its utility, the software has accumulated sixty-one Common Vulnerabilities and Exposures (CVEs), indicating significant historical security debt. The most prevalent vulnerability classes involve server-side request forgery, insecure direct object references, and cross-site scripting, often stemming from inadequate input validation in its web interface. Additionally, several issues relate to improper access control, allowing unauthorized users to manipulate experiment data or execute arbitrary code through crafted requests. While no single catastrophic breach has publicly defined its history, the high volume of CVEs suggests systemic weaknesses in authentication and session management. These flaws primarily impact the integrity and confidentiality of machine learning workflows, requiring rigorous patching and secure configuration by administrators to mitigate risks associated with its widely adopted tracking and model serving components.

Top products by mlflow: mlflow/mlflow MLflow
CVE ID Title CVSS Severity Published
CVE-2025-11200 MLflow Weak Password Requirements Authentication Bypass Vulnerability — MLflow CWE-521 9.8AI Critical AI 2025-10-29
CVE-2025-11201 MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability — MLflow CWE-22 9.8AI Critical AI 2025-10-29
CVE-2025-0453 Denial of Service through Batched Queries in GraphQL in mlflow/mlflow — mlflow/mlflow CWE-410 7.5 - 2025-03-20
CVE-2025-1473 CSRF in mlflow/mlflow — mlflow/mlflow CWE-352 8.8 - 2025-03-20
CVE-2025-1474 Weak Password Requirements in mlflow/mlflow — mlflow/mlflow CWE-521 9.8 - 2025-03-20
CVE-2024-8859 Path Traversal in mlflow/mlflow — mlflow/mlflow CWE-29 7.5 - 2025-03-20
CVE-2024-6838 Uncontrolled Resource Consumption in mlflow/mlflow — mlflow/mlflow CWE-400 8.2 - 2025-03-20
CVE-2024-2928 Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow — mlflow/mlflow CWE-29 7.5AI High AI 2024-06-06
CVE-2024-0520 Remote Code Execution due to Full Controlled File Write in mlflow/mlflow — mlflow/mlflow CWE-22 9.8AI Critical AI 2024-06-06
CVE-2024-3099 Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow — mlflow/mlflow CWE-475 8.1AI High AI 2024-06-06
CVE-2024-37061 MLflow 安全漏洞 — MLflow CWE-94 8.8 High 2024-06-04
CVE-2024-37060 MLflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37059 Mlflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37058 MLflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37057 MLflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37056 MLflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37055 MLflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37054 MLflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37053 Mlflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-37052 Mlflow 安全漏洞 — MLflow CWE-502 8.8 High 2024-06-04
CVE-2024-4263 Improper Access Control in mlflow/mlflow — mlflow/mlflow CWE-284 8.1AI High AI 2024-05-16
CVE-2024-3848 Path Traversal Bypass in mlflow/mlflow — mlflow/mlflow CWE-29 7.5AI High AI 2024-05-16
CVE-2024-3573 Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow — mlflow/mlflow CWE-29 7.5 - 2024-04-16
CVE-2024-1594 Local File Read via Path Traversal in mlflow/mlflow — mlflow/mlflow CWE-22 7.5 - 2024-04-16
CVE-2024-1558 Path Traversal Vulnerability in mlflow/mlflow — mlflow/mlflow CWE-22 6.5 - 2024-04-16
CVE-2024-1593 Path Traversal via Parameter Smuggling in mlflow/mlflow — mlflow/mlflow CWE-22 9.1 - 2024-04-16
CVE-2024-1560 Path Traversal Vulnerability in mlflow/mlflow — mlflow/mlflow CWE-22 7.5 - 2024-04-16
CVE-2024-1483 Path Traversal Vulnerability in mlflow/mlflow — mlflow/mlflow CWE-22 7.5 - 2024-04-16
CVE-2023-6977 Path Traversal: '\..\filename' — mlflow/mlflow CWE-29 6.5 - 2023-12-20
CVE-2023-6976 Unrestricted Upload of File with Dangerous Type — mlflow/mlflow CWE-434 9.1 - 2023-12-20

This page lists every published CVE security advisory associated with mlflow. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.