mlflow — Vulnerabilities & Security Advisories 78

Browse all 78 CVE security advisories affecting mlflow. AI-powered Chinese analysis, POCs, and references for each vulnerability.

MLflow is an open-source platform designed for the machine learning lifecycle, facilitating experiment tracking, reproducibility, and deployment. Despite its utility, the software has accumulated sixty-one Common Vulnerabilities and Exposures (CVEs), indicating significant historical security debt. The most prevalent vulnerability classes involve server-side request forgery, insecure direct object references, and cross-site scripting, often stemming from inadequate input validation in its web interface. Additionally, several issues relate to improper access control, allowing unauthorized users to manipulate experiment data or execute arbitrary code through crafted requests. While no single catastrophic breach has publicly defined its history, the high volume of CVEs suggests systemic weaknesses in authentication and session management. These flaws primarily impact the integrity and confidentiality of machine learning workflows, requiring rigorous patching and secure configuration by administrators to mitigate risks associated with its widely adopted tracking and model serving components.

Top products by mlflow: mlflow/mlflow MLflow

CVE ID	Title	CVSS	Severity	Published
CVE-2023-6975	Path Traversal: '\..\filename' — mlflow/mlflow CWE-29	8.1	-	2023-12-20
CVE-2023-6974	Server-Side Request Forgery (SSRF) — mlflow/mlflow CWE-918	9.8	-	2023-12-20
CVE-2023-6940	Command Injection — mlflow/mlflow CWE-77	8.8	-	2023-12-19
CVE-2023-6909	Path Traversal: '\..\filename' in mlflow/mlflow — mlflow/mlflow CWE-29	8.1^AI	High ^AI	2023-12-18
CVE-2023-6831	Path Traversal: '\..\filename' in mlflow/mlflow — mlflow/mlflow CWE-29	8.1	-	2023-12-15
CVE-2023-6753	Path Traversal in mlflow/mlflow — mlflow/mlflow CWE-22	8.1^AI	High ^AI	2023-12-13
CVE-2023-6709	Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow — mlflow/mlflow CWE-1336	9.4^AI	Critical ^AI	2023-12-12
CVE-2023-6568	Reflected XSS via Content-Type Header in mlflow/mlflow — mlflow/mlflow CWE-79	6.1	-	2023-12-07
CVE-2023-6014	MLflow Authentication Bypass — mlflow/mlflow CWE-598	7.5	-	2023-11-16
CVE-2023-6015	MLflow Arbitrary File Upload — mlflow/mlflow CWE-22	9.8	-	2023-11-16
CVE-2023-6018	MLflow Arbitrary File Write — mlflow/mlflow CWE-78	9.1	-	2023-11-16
CVE-2023-4033	OS Command Injection in mlflow/mlflow — mlflow/mlflow CWE-78	7.2	-	2023-08-01
CVE-2023-3765	Absolute Path Traversal in mlflow/mlflow — mlflow/mlflow CWE-36	4.3	-	2023-07-19
CVE-2023-2780	Path Traversal: '\..\filename' in mlflow/mlflow — mlflow/mlflow CWE-29	8.1	-	2023-05-17
CVE-2023-2356	Relative Path Traversal in mlflow/mlflow — mlflow/mlflow CWE-23	7.7	-	2023-04-28
CVE-2023-1177	Path Traversal: '\..\filename' in mlflow/mlflow — mlflow/mlflow CWE-29	9.3	Critical	2023-03-24
CVE-2023-1176	Absolute Path Traversal in mlflow/mlflow — mlflow/mlflow CWE-36	7.1	-	2023-03-24
CVE-2022-0736	Insecure Temporary File in mlflow/mlflow — mlflow/mlflow CWE-377	7.1	-	2022-02-23

This page lists every published CVE security advisory associated with mlflow. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.