CVE-2025-14287High· 7.5▾ TwilightMLflow has a command injection in mlflow/sagemaker/__init__.py
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.5%
Last analysed / modified upstream
A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the mlflow/sagemaker/__init__.py file at lines 161-167. The vulnerability arises from the direct interpolation of user-supplied container image names into shell commands without proper sanitization, which are then executed using os.system(). This allows attackers to execute arbitrary commands by supplying malicious input through the --container parameter of the CLI. The issue affects environments where MLflow is used, including development setups, CI/CD pipelines, and cloud deployments.
mlflow < 3.8.0rc0Upgrade to a patched release:
mlflow 3.8.0rc0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-2033High· 8.1MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
CVE-2025-15036Critical· 9.6MLFlow path traversal vulnerability
CVE-2026-33866Medium· 4.3MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
CVE-2025-15379Critical· 10.0A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function
CVE-2026-8147High· 8.1MLflow: trace API endpoints lack proper authorization validators
CVE-2026-71211High· 7.1MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim