repository icon
mlflow / mlflow Project repository

Open source platform for the machine learning lifecycle

Submit a report

FIRST INTERACTION

WITHIN3 DAYS

REVIEW

WITHIN3 DAYS

FIX

WITHINN/A DAYS

Broken Access Control: 31 v3 API Endpoints Missing Authorization Validators in M...
lewlademp
duplicate
High
Zero-Click Remote Code Execution (RCE) via Deserialization in mlflow.genai.list_...
samir-atra
duplicate
Critical
Arbitrary Module Import via pickle_module_info.txt in MLflow PyTorch Model Loadi...
hacnho
duplicate
High
Arbitrary File Read via Tar Symlink Bypass of Path Traversal Fix in mlflow/mlflo...
hacnho
duplicate
Medium
Default config allows unauthenticated pickle RCE via model upload API
csaw-admin
duplicate
Critical
Vulnerability Report: Remote Code Execution (RCE) in `mlflow.genai.scorers`
samir-atra
duplicate
Critical
_safe_extractall() TOCTOU Bypass Allows Arbitrary File Write Through Crafted Mod...
willardjansen
duplicate
High
Path Traversal in `LocalArtifactRepository.delete_artifacts()` allows arbitrary...
caoxuyang
duplicate
High
Remote Code Execution via unsanitized `func_name` in `exec()` call in `recreate_...
caoxuyang
duplicate
Critical
Incomplete fix for PR #18964: delete_artifacts() still missing validate_path_wit...
gengyscan
duplicate
High
Path Traversal in Multipart Upload Artifact Endpoints
scruge1
duplicate
High
Arbitrary File Read/Write via Tar Hardlink Bypass in check_tarfile_security
akasxh
duplicate
Critical
check_tarfile_security() validates symlinks but not hardlinks, allowing arbitrar...
scruge1
duplicate
Medium
Multiple deserialization paths bypass MLFLOW_ALLOW_PICKLE_DESERIALIZATION safe...
scruge1
duplicate
High
Unsafe pickle.load() Without Safety Gate in PickleEvaluationArtifact
twsky100
duplicate
High
Alternative unauthenticated entry point to scorer exec() via Jobs API bypasses f...
den-sec
duplicate
Critical
Remote Code Execution via Unguarded pickle.load() in PickleEvaluationArtifact
snailsploit
duplicate
Critical
Pickle deserialization guard bypass in PickleEvaluationArtifact
buttergolemcode
duplicate
High
Insecure Default: `MLFLOW_ALLOW_PICKLE_DESERIALIZATION=True` Bypasses Deserializ...
artqcid
duplicate
High
SSRF via Unvalidated URL in mlflow.projects.run()
wheresfrank
duplicate
High
Server-Side Request Forgery (SSRF) in MLflow Gateway via unvalidated api_base UR...
elucidator-hky
duplicate
Critical
ReDoS via RLIKE operator in Trace Search API allows unauthenticated denial of se...
elucidator-hky
duplicate
High
Authorization bypass in Evaluation Dataset, Assessment, and Issue APIs allows an...
elucidator-hky
duplicate
High
RCE via unsanitized exec() in scorer deserialization at /ajax-api/3.0/mlflow/sco...
victoratus
duplicate
High
Systematic Missing Authorization on V3.0 API Endpoints Allows Cross-User Data Ac...
elucidator-hky
duplicate
High
CRLF Log Injection via Unsanitized Host and Origin Headers in Security Middlewar...
pelegs202-design
not applicable
Missing Authorization on Issues and Assessments API Endpoints
joshuaswanson
duplicate
High
Unsafe torch.load() in MLflow PyTorch Integration Enables RCE via Malicious Mode...
odysseypro25-project
not applicable
Unsafe pickle.load() and cloudpickle.load() in MLflow sklearn/pyfunc/dspy Enable...
odysseypro25-project
spam
Password Validation Bypassed on Password Update Allowing Single-Character Passwo...
pelegs202-design
not applicable
Gateway Passthrough Forwards Arbitrary Client Headers to LLM Providers Enabling...
pelegs202-design
not applicable
Cross-Site Request Forgery on All State-Changing API Endpoints Due to Disabled C...
pelegs202-design
not applicable
MLflow Pickle Deserialization RCE via Insecure Model Loading
skykan999
self closed
MLflow Pickle Deserialization RCE via Insecure Model Loading
skykan999
self closed
Full-Read SSRF via Unvalidated api_base in Gateway Endpoint Configuration
2201029-cyber
duplicate
High
Exception Details Leaked to HTTP Clients via Error Response Serialization
pelegs202-design
not applicable
RLIKE Regex Injection into Database Engine via Trace Search API
pelegs202-design
duplicate
High
Type Coercion in is_admin Parameter Causes Privilege Escalation via Truthy Strin...
pelegs202-design
not applicable
Hardcoded Default Admin Credentials Enable Unauthenticated Full Server Takeover
pelegs202-design
not applicable
SQL Injection via Unparameterized type_text in Unity Catalog Function Invocation
pelegs202-design
spam
Fail-Open Authorization: 30+ Auth-Plugin Endpoints Missing Permission Validators
pelegs202-design
spam
Arbitrary Code Execution via Unconstrained importlib.import_module in PyTorch Mo...
pelegs202-design
spam
Arbitrary Code Execution via Unconstrained importlib.import_module in LlamaIndex...
pelegs202-design
spam
Missing path validation in delete_artifacts() across multiple ArtifactRepository...
eistee82
self closed
Explicit weights_only=False in _load_pyfunc() enables RCE via Remote Model URI i...
theoddesseyp-ai
not applicable
Security Check Bypass in check_tarfile_security — Symlink Target Not Validated
goblinmode2700
duplicate
None
Zip Slip Arbitrary File Write in Spark Model Distribution
goblinmode2700
spam
Zip Slip Arbitrary File Write via Malicious Project Archive
goblinmode2700
spam
check_tarfile_security Bypass via Empty-Named Symlink Chain Enables Arbitrary Fi...
psdat123
duplicate
Critical
Broken Access Control on Issue/Assessment/Dataset/TraceV3 APIs — any authenticat...
romain-deperne
duplicate
Medium
IDOR on Issue Management API — Any Authenticated User Can Read, Modify and Enume...
prabhalendamuri15-lab
duplicate
High
Arbitrary Code Execution via importlib.import_module() with Model-Artifact-Contr...
elucidator-hky
spam
Authenticated Read/Delete Authorization Bypass on Evaluation Datasets
ch1nhpd
duplicate
High
Arbitrary Code Execution via Attacker-Controlled Pickle Module Import Bypasses _...
elucidator-hky
self closed
Arbitrary code execution via unsafe pickle.load() and cloudpickle.load() in mult...
elucidator-hky
self closed
Zip Slip Vulnerability in Project Fetching Allows Arbitrary File Write
elucidator-hky
self closed
Arbitrary Code Execution via Scorer Deserialization in _invoke_scorer_handler
odysseypro25-project
duplicate
None