[ Vendor · 5 CVEs ]
MLflow
CVEs affecting MLflow published in the last 30 days, plus any MLflow CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-53995 | 19 Oct 2026 | CVSS 8.2 | mlflowMLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control… | |
| CVE-2026-96775 | 23 Sep 2026 | CVSS 8.8 | MLflowMLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl… | |
| CVE-2026-96804 | 23 Sep 2026 | CVSS 8.8 | MLflowMLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model()… | |
| CVE-2026-64849 | 17 Aug 2026 | CVSS 9.3 | MLflow Server-Side Request ForgeryMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to… | ExploitedFix |
| CVE-2026-64849 | 17 Aug 2026 | CVSS 9.3 | MLflow Server-Side Request ForgeryMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to… | ExploitedFix |