repository icon
mlflow / mlflow Project repository

Open source platform for the machine learning lifecycle

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN8 DAYS

FIX

WITHIN90 DAYS

Registry auth bypass in CreateModelVersion lets a low-privileged user proxy-read...
justmahmoud1
pending
Path traversal via unsanitized trace_id in StartTraceV3 allows arbitrary file wr...
mch-byte
pending
SSRF: Unvalidated provider URL in MLflow AI Gateway enables internal network acc...
01data-ai
pending
Pickle RCE: Unauthenticated arbitrary file upload to artifact storage enables su...
01data-ai
self closed
Authenticated SSRF and LLM API key exfiltration via api_base injection in lm_kwa...
white-hat-lab
pending
Auth Bypass: All MLflow REST API endpoints accessible without authentication in...
01data-ai
pending
Workspace-scoping and auth bypass on /mlflow-artifacts/presigned leaks cross-wor...
justmahmoud1
pending
Authenticated algorithmic DoS in SearchExperiments / SearchRegisteredModels perm...
justmahmoud1
pending
MLflow PyFunc Model Loader - Path Traversal Leading to Arbitrary Code Execution
jayantkamble10000
duplicate
Critical
Unvalidated artifact_location Enables Artifact URI Poisoning Leading to Client-S...
sark4
duplicate
High
Missing object-level authorization on /ajax-api/3.0/mlflow/issues/invoke allows...
white-hat-lab
duplicate
High
Command Injection in Container Model Serving via Unsanitized Conda Env Path (Inc...
patchmyday
duplicate
High
Unauth RCE in mlflow assistant API when mlflow is behind a same-host reverse pro...
0xbosz
duplicate
Critical
Guardrail bypass via client-supplied `X-MLflow-Guardrail-Bypass` header — `gatew...
snakeyworm
not applicable
Guardrail bypass via client-supplied `X-MLflow-Guardrail-Bypass` header — `gatew...
snakeyworm
pending
63 API Endpoints Missing Authorization Validators When Basic-Auth Plugin is Enab...
penguinmiaou
pending
AI Gateway Guardrail Bypass via X-MLflow-Guardrail-Bypass HTTP Header
penguinmiaou
not applicable
Guardrail bypass via client-supplied `X-MLflow-Guardrail-Bypass` header — `gatew...
snakeyworm
not applicable
Universal Encryption Key for Gateway Secrets — All Default MLflow Installations...
pkmdev-sec
pending
Authorization Bypass on API Endpoints — Default-Allow When No Validator Register...
pkmdev-sec
pending
PickleEvaluationArtifact Bypasses MLFLOW_ALLOW_PICKLE_DESERIALIZATION Safety Gat...
pkmdev-sec
pending
Client-Side Arbitrary File Write via Path Traversal in ArtifactRepository._creat...
pkmdev-sec
pending
Unauthenticated Experiment Destruction via POST /ajax-api/3.0/mlflow/demo/delete...
microwaveovens-yay
pending
Arbitrary Code Execution via unsafe `torch.load()` in MLflow Lightning autolog a...
ryanwms24
pending
SSRF Blocklist Bypass in Model Registry Source Validation — Cloud Metadata and A...
nisartest20-bit
pending
PickleEvaluationArtifact bypasses MLFLOW_ALLOW_PICKLE_DESERIALIZATION — RCE via...
n0x00x
pending
AI Gateway guardrail bypass via unauthenticated X-MLflow-Guardrail-Bypass header
willardjansen
pending
Pre-auth server-side file write via attacker-controlled `experiment.artifact_loc...
justmahmoud1
duplicate
High
Authorization bypass on parameterized basic-auth routes via exact-string validat...
justmahmoud1
pending
Authorization bypass in basic-auth for trace, assessment, and evaluation dataset...
justmahmoud1
duplicate
High
Pre-auth arbitrary file read via mutable mlflow.artifactLocation trace tag and u...
justmahmoud1
pending
Arbitrary Working Directory via PUT /config
yacwagh
pending
Path Traversal via Unvalidated custom_path in MLflow Assistant Skills Install AP...
yacwagh
pending
Incomplete Fix for Scorer Exec RCE: _invoke_scorer_handler Still Allows Arbitrar...
dimasma0305
pending
Missing authorization on ~12 MLflow trace endpoints — any authenticated user can...
snakeyworm
duplicate
High
SSRF via DNS rebinding TOCTOU in webhook URL validation — `/webhooks/{id}/test`...
snakeyworm
pending
Command Injection via Unsanitized Conda Environment File Name
0xhunter213
duplicate
Critical
Command Injection via pip_requirements_override in Virtualenv Execution Path
rook2135
duplicate
High
Incomplete Fix for CVE-2025-15379: Command Injection via python_env.yaml in Virt...
rook2135
duplicate
Critical
Unauthenticated Artifact Upload via POST /ajax-api/2.0/mlflow/upload-artifact...
microwaveovens-yay
duplicate
High
Missing object-level authorization on trace endpoints allows cross-experiment...
zx41r
duplicate
High
Command Injection via Unquoted Model Path in `serve_stdin` Execution Path
0xmanan
duplicate
Critical
MLflow SSRF in _fetch_zip_repo — Arbitrary HTTP Requests to Internal Services
radikhoroshev
duplicate
None
MLFLOW_ALLOW_PICKLE_DESERIALIZATION Bypass via DSPy Native Model Format Leads to...
skillwager
duplicate
None
Broken Access Control: Unauthenticated LLM Gateway Invocation via POST /gateway/...
microwaveovens-yay
pending
Broken Access Control: Unauthenticated Arbitrary Job Execution via POST /ajax-ap...
microwaveovens-yay
duplicate
Critical
MLflow pyfunc loader_module Arbitrary Code Execution (CWE-470, CVSS 8.8)
nitaydariel
duplicate
High
MLflow Project URI SSRF via _fetch_zip_repo — Arbitrary HTTP Requests to Interna...
radikhoroshev
duplicate
High
Insecure Default in PyFunc CloudPickle Deserialization Leads to Remote Code Exec...
crazymarky
duplicate
High
RCE via loader_module arbitrary import in mlflow.pyfunc.load_model()
ryansecurityfanpierlabs
pending
SSRF via Unvalidated openai_api_base in MLflow AI Gateway Endpoints
lexi-core-ai
pending
Arbitrary File/Directory Deletion via Path Traversal in LocalArtifactRepository....
lexi-core-ai
pending
Arbitrary File/Directory Deletion via Path Traversal in LocalArtifactRepository....
lexi-core-ai
pending
Missing Authorization on Online Scoring Config Endpoints Allows Any Authenticate...
rael-ivar
pending
MLflow Webhook SSRF via HTTP Redirect Bypass
sam8k
pending
Missing Authentication for Critical Function: mlflow Assistant API Allows Unauth...
sukhawarring
duplicate
Critical
Critical rce in mlflow pyfunc via flavor confusion and loader_module hijack
deneimaiegww
pending
Server-Side Request Forgery (SSRF) via Gateway API auth_config.api_base
pablogar0
pending
Zip slip arbitrary file write via unsafe extractall() when fetching remote MLflo...
snakeyworm
pending
Missing authorization on issue detection endpoint exposes gateway secrets — any...
snakeyworm
duplicate
High
Authenticated users can read, enumerate, and cancel arbitrary jobs via /ajax-api...
d4rkpsych0p4th
pending
MLFLOW_ALLOW_PICKLE_DESERIALIZATION Bypass via DSPy Native Model Format Enables...
skillwager
pending
MLflow mlflow.projects.run OS Command Injection via Unsanitized Parameter Key (r...
longze666
pending
Unsafe pickle deserialization via torch.load without weights_only + inverted MLF...
elliottower
pending
SSRF via user-controlled ZIP URI in mlflow.projects.run() + ZipSlip arbitrary fi...
elliottower
duplicate
High
Arbitrary code execution via exec() on deserialized scorer source code from trac...
elliottower
pending
Missing Authorization for 8 Gateway Guardrail API Endpoints in basic-auth Plugin
eiki-takeshita
pending
Arbitrary File Write via Unrestricted artifact_location in mlflow.create_experim...
sucloudflare
pending
Broken Object Level Authorization: Online Scoring Config Endpoints Explicitly Ex...
sonumishraa
pending
Authorization Bypass in GetPresignedDownloadUrl Endpoint Allows Unauthorized Art...
rook2135
pending
Missing Shell Argument Escaping in PyFunc Backend serve_stdin Allows Potential C...
sonumishraa
duplicate
High
Path Traversal in SFTP and HDFS Artifact Repository delete_artifacts() Enables U...
sonumishraa
pending
Command Injection via pip_requirements_override in Virtualenv Execution Path
rook2135
pending
Test Title
rook2135
self closed
Incomplete Fix for CVE-2025-15379: Command Injection via python_env.yaml in Virt...
rook2135
pending
Command Injection via pip_requirements_override in Virtualenv Execution Path
rook2135
self closed
Incomplete Fix for CVE-2025-15379: Command Injection via python_env.yaml in Virt...
rook2135
self closed
Cloud Credential Exposure via Docker CLI Arguments in MLflow Projects Backend
sonumishraa
pending
Hardcoded default passphrase in MLflow KEK derivation allows decryption of all s...
javitoia
pending
Remote Code Execution via Models-from-Code bypasses pickle guard — arbitrary Pyt...
javitoia
duplicate
Critical
Full-Read SSRF via DNS Rebinding in Webhook Delivery (TOCTOU in _send_webhook_re...
sonumishraa
pending
Arbitrary local file read via path traversal in prompt model version source — by...
winstoncrooker
pending
Path Traversal in LocalArtifactRepository.delete_artifacts() Allows Arbitrary Fi...
sonumishraa
self closed
MLflow Remote Code Execution via Unsanitized Parameter Key in compute_command()
sucloudflare
pending
Legacy gateway proxy bypasses can_use authorization on AI Gateway endpoints
eaea0001
pending
MLflow Job API Missing Authorization Allows Viewer RCE and Full Server Compromis...
kimkou2024
pending
Arbitrary Code Execution via Unvalidated model_class in XGBoost Flavor
sark4
pending
Incomplete Fix of CVE-2025-15379: Command Injection via Conda Env Path
sark4
duplicate
Critical
Path Traversal in LocalArtifactRepository.delete_artifacts() allows arbitrary fi...
jdhart81
pending
Scorer Invoke Endpoint Mapped to Permissive Gateway Proxy Validator - Any User C...
lihfdgjr
pending
Evaluation Dataset API v3 Endpoints Missing Authorization - Any Authenticated Us...
lihfdgjr
pending
Issue Detection Endpoint Missing Authorization - Any User Can Invoke Issue Detec...
lihfdgjr
pending
Online Scoring Config Endpoints Deliberately Excluded from Authorization Validat...
lihfdgjr
pending
Gateway Guardrail API Missing Authorization - Any Authenticated User Can Disable...
lihfdgjr
pending
Missing authorization validators allow any authenticated user to bypass experime...
lamkus
pending
SSRF via Unvalidated artifact_location Parameter in MLflow Experiment Creation -...
jtjisgod
duplicate
Critical
Webhook test endpoint returns full response body — Full-Read SSRF via DNS rebind...
lamkus
pending
Remote Code Execution in MLflow via Malicious Pickle Model Artifacts
haroon0x
pending
Authorization Bypass — Multiple Endpoints Missing Validators in basic-auth Mode
lamkus
pending
Webhook Test Endpoint Returns Full Response Body — SSRF with Data Exfiltration
lamkus
pending
Unsafe ZIP extraction in mlflow.projects.run() allows arbitrary file write (ZipS...
lamkus
pending
Command Injection in serve_stdin() via unquoted local_path in bash -c
kimkou2024
duplicate
High
SSRF IP Validation Bypass via HTTP Redirect in Webhook Delivery
deezsecc
pending
mlflow.projects.run() injects unsanitized parameter keys into shell commands
ichiburn
pending
SSRF via DNS Rebinding in Webhook URL Validation
sampsonc
pending
All Default MLflow Deployments Share Identical Encryption Key for Gateway API Se...
christauff
pending
Scorer Online-Config Endpoints Explicitly Excluded from Authorization Validators...
christauff
pending
MLflow Webhooks: full-read SSRF via HTTP redirect
resohalasamo
pending
MLflow Assistant API: localhost-check bypass leading to remote code execution
resohalasamo
duplicate
High
Missing Authorization on Gateway Guardrail Routes (mlflow.server.auth)
resohalasamo
pending
Incomplete prompt source validation allows local file read (bypass of PR #20833)
ichiburn
pending
Authorization bypass on all trace endpoints when auth is enabled
ayushparkara
High
•$1050•CVE-2026-8147
[CWE-77] MLflow — Command Injection via CONDA env_manager Bypass of CVE-2025-153...
doubledoze
duplicate
Critical
Missing Authorization in MLflow Online Scoring Configuration API
crazymarky
pending
Arbitrary code execution via unchecked importlib.import_module in _get_class_fro...
marwan9696
pending
Authorization bypass in Dataset, Issue, and Demo endpoints missing from BEFORE_R...
marwan9696
pending
SSRF via HTTP Redirect Bypass in Webhook Delivery
mlgzackfly
duplicate
High
Zip Slip Path Traversal in Spark Model Distribution via zipfile.extractall()
manja316
pending
CreateGatewaySecret missing from BEFORE_REQUEST_HANDLERS allows any authenticate...
marwan9696
pending
Zip Slip via zipfile.extractall() Without Path Validation in Project Import
lamkus
pending
Assistant API Localhost Check Bypass via Reverse Proxy Leads to Remote Code Exec...
vuvannam-sec
duplicate
Critical
Incomplete Authorization Fix on Job API — PR #20920 Added Authentication but Not...
vuvannam-sec
pending
Multiple AJAX and API endpoints bypass experiment-level authorization allowing c...
neimasilk
pending
Any authenticated user can download artifacts from any experiment via /get-ar...
neimasilk
pending
Fail-open design in FastAPI auth middleware: new routes bypass authentication by...
n1neman
pending
Argument injection via model python_env.yaml dependencies allows malicious pip f...
n1neman
pending
Workspace isolation bypass in presigned URL endpoint allows cross-tenant artifac...
n1neman
pending
Stored SSRF via artifact_location in experiment creation — no URL scheme restric...
n1neman
duplicate
None
SSRF protection bypass in webhook delivery via HTTP redirect (307)
n1neman
pending
Arbitrary code execution via unsanitized loader_module in MLflow model artifacts
n1neman
duplicate
Critical
Missing validate_path_is_safe() on Request Body Path in Multipart Upload Endpoin...
ryanhugh-security-fanpierlabs
pending
Broken Access Control: 31 v3 API Endpoints Missing Authorization Validators in M...
lewlademp
duplicate
High
Gateway Secret API Authorization Bypass: Any Authenticated User Can Create, List...
davidaroca27
duplicate
High
Incomplete Fix for CVE-2025-15379: Command Injection in CONDA env_manager Path (...
davidaroca27
duplicate
High
Zero-Click Remote Code Execution (RCE) via Deserialization in mlflow.genai.list_...
samir-atra
duplicate
Critical
Incomplete fix for CVE-2025-15379: conda env manager branch still vulnerable to...
eedndee
duplicate
High
Python Module Hijacking via sys.path.insert in MLflow MLmodel code Field in mlfl...
hacnho
pending
Arbitrary Module Import via pickle_module_info.txt in MLflow PyTorch Model Loadi...
hacnho
duplicate
High
Arbitrary File Read via Tar Symlink Bypass of Path Traversal Fix in mlflow/mlflo...
hacnho
duplicate
Medium
Default config allows unauthenticated pickle RCE via model upload API
csaw-admin
duplicate
Critical
Arbitrary Class Instantiation via importlib in LlamaIndex Object Deserialization...
tranhoangtu-it
pending
Arbitrary Code Execution via exec() in Scorer Deserialization with Bypassable Da...
tranhoangtu-it
pending
Gzip Bomb Denial of Service via OTLP Trace Ingestion Endpoint
gv94
pending
Critical Unauthenticated CRUD on MLflow 3.10.1 Tracking API Endpoints
velvetfox24
pending
Unauthenticated Remote Code Execution (RCE) via Chain of AI Gateway POST SSRF an...
m1axcc
pending
Unsafe zip extraction allows path traversal and arbitrary file write via MLflow...
tranhoangtu-it
pending
SSRF via artifact_location FTP/SFTP Scheme Bypass
axel-corsiez
pending