MLflow vulnerabilities

CVEs whose affected-version data names the MLflow package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

56 CVEsRSS

CVE-2025-11200High· 8.10day

MLflow Weak Password Requirements Authentication Bypass Vulnerability

MLflow Weak Password Requirements Authentication Bypass Vulnerability

▾ Abyssalmlflow · mlflowEPSS 1.5%via OSV

CVE-2025-11201High· 8.10day

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

▾ Abyssalmlflow · mlflowEPSS 27%via OSV

CVE-2024-6838Medium· 5.3

MLflow Uncontrolled Resource Consumption vulnerability

MLflow Uncontrolled Resource Consumption vulnerability

▾ Sunlitmlflow · mlflowEPSS 0.65%via OSV

CVE-2025-1473Medium· 5.4

MLflow Cross-Site Request Forgery (CSRF) vulnerability

MLflow Cross-Site Request Forgery (CSRF) vulnerability

▾ Sunlitmlflow · mlflowEPSS 0.22%via OSV

CVE-2024-8859High· 7.5PoC

MLflow has a Local File Read/Path Traversal in dbfs

MLflow has a Local File Read/Path Traversal in dbfs

▾ Midnightmlflow · mlflowEPSS 2.7%via OSV

CVE-2025-0453Medium· 5.9

MLflow Uncontrolled Resource Consumption vulnerability

MLflow Uncontrolled Resource Consumption vulnerability

▾ Sunlitmlflow · mlflowEPSS 11%via OSV

CVE-2024-3099Medium· 5.4

Undefined Behavior in mlflow

Undefined Behavior in mlflow

▾ Sunlitmlflow · mlflowEPSS 0.44%via OSV

CVE-2024-37055High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.62%via OSV

CVE-2024-37059High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.62%via OSV

CVE-2024-37061High· 8.8

MLFlow improper input validation

MLFlow improper input validation

▾ Twilightmlflow · mlflowEPSS 0.88%via OSV

CVE-2024-37057High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.62%via OSV

CVE-2024-37054High· 8.8PoC

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Midnightmlflow · mlflowEPSS 0.70%via OSV

CVE-2024-37058High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.62%via OSV

CVE-2024-37060High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.78%via OSV

CVE-2024-37056High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.62%via OSV

CVE-2024-37052High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.62%via OSV

CVE-2024-37053High· 8.8

MLFlow unsafe deserialization

MLFlow unsafe deserialization

▾ Twilightmlflow · mlflowEPSS 0.62%via OSV

CVE-2024-1594High· 7.5

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

▾ Twilightmlflow · mlflowEPSS 0.71%via OSV

CVE-2024-1558High· 7.5

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

▾ Twilightmlflow · mlflowEPSS 0.86%via OSV

CVE-2024-1483High· 7.5PoC

mlflow Path Traversal vulnerability

mlflow Path Traversal vulnerability

▾ Midnightmlflow · mlflowEPSS 2.7%via OSV

CVE-2024-1593High· 7.5

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

▾ Twilightmlflow · mlflowEPSS 0.69%via OSV

CVE-2024-1560High· 8.1

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

▾ Twilightmlflow · mlflowEPSS 0.86%via OSV

CVE-2023-6976High· 8.8

MLflow Path Traversal Vulnerability

MLflow Path Traversal Vulnerability

▾ Twilightmlflow · mlflowEPSS 1.0%via OSV

CVE-2023-6977High· 7.5PoC

MLflow Local File Disclosure Vulnerability

MLflow Local File Disclosure Vulnerability

▾ Midnightmlflow · mlflowEPSS 3.9%via OSV

CVE-2023-6940High· 8.8

mlflow Command Injection vulnerability

mlflow Command Injection vulnerability

▾ Twilightmlflow · mlflowEPSS 1.2%via OSV

CVE-2023-43472High· 7.5PoC

Information exposure in MLflow

Information exposure in MLflow

▾ Midnightmlflow · mlflowEPSS 37%via OSV

MLflow vulnerabilities (CVEs) — page 2 · VulnSea