Data

Tools

Indexes

Applications

Experiments

Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

pypi

mlflow

pypi

MLflow is an open source platform for the complete machine learning lifecycle

View on github.com · View on pypi.org

Security Advisories for mlflow in pypi

High
12 days ago

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source GSA_kwCzR0hTQS1tNjVwLTlqN3EtNnczM84AB_rF

pypi mlflow
Moderate
12 days ago

MLflow CrewAI autologging records LLM provider API keys in logged trace spans GSA_kwCzR0hTQS1qN3FxLXZyOGMteHZ3M84AB_rE

pypi mlflow
Critical
12 days ago

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules GSA_kwCzR0hTQS0yNnA4LTJqcTktM3ZxOc4AB_rD

pypi mlflow
Moderate
16 days ago

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints GSA_kwCzR0hTQS0yd3FwLXEzYzYtY2NqNc4AB_Rh

pypi mlflow
High
20 days ago

MLflow FileStore trace IDs allow path traversal and arbitrary file writes GSA_kwCzR0hTQS13cW1oLXFjY3ctcHF3Zs4AB-Z_

pypi mlflow
High
2 months ago

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact GSA_kwCzR0hTQS1ncXZnLWdtbXgteDRobc4ABnVU

pypi mlflow
Critical
3 months ago

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) GSA_kwCzR0hTQS03Z3dwLTVwZnAtOTY5as4ABkXC

pypi mlflow
High
3 months ago

MLflow AI Gateway permits SSRF through an unvalidated api_base GSA_kwCzR0hTQS1oN3gyLWg2ZzktcDc4Oc4ABhVz

pypi mlflow
High
4 months ago

MLflow: trace API endpoints lack proper authorization validators GSA_kwCzR0hTQS0yY202LXI3N3ctNmc5Ns4ABaBh

pypi mlflow
Low
5 months ago

MLflow: Deterministic sampling in dataset digest enables predictable collisions GSA_kwCzR0hTQS01cW1wLXAzYzQtNzJxas4ABYCQ

pypi mlflow
Critical
5 months ago

MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration GSA_kwCzR0hTQS1nMzVwLXB4MzItd2h2Ns4ABX_B

pypi mlflow
Moderate
5 months ago

MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions GSA_kwCzR0hTQS1yNW05LXdtNDktOTU5Zs4ABX8m

pypi mlflow
Critical
6 months ago

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled GSA_kwCzR0hTQS04YzdxLTg2ZnEtdnZtaM4ABXVv

pypi mlflow
Moderate
6 months ago

MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks GSA_kwCzR0hTQS13NXhxLWM0cGYtZ2hxN84ABXLm

pypi mlflow
Critical
6 months ago

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution GSA_kwCzR0hTQS02N2M1LXg1bWYtcnBwcc4ABXFJ

pypi mlflow
High
6 months ago

MLFlow Creates a Temporary File With Insecure Permissions GSA_kwCzR0hTQS1mMm05LXdjZjQtY3d3eM4ABXCZ

pypi mlflow
High
6 months ago

MLflow: unauthenticated access to certain FastAPI routes GSA_kwCzR0hTQS03NWNtLXgydzMtOG1nZs4ABW7L

pypi mlflow
High
6 months ago

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem GSA_kwCzR0hTQS00Mmg1LWg4cWgtdnY5ds4ABWmu

pypi mlflow
High
6 months ago

MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability GSA_kwCzR0hTQS02NWg3LWM3YzQtbWdoeM4ABWlZ

pypi mlflow
Moderate
7 months ago

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface GSA_kwCzR0hTQS1maDY0LXIydmMteHZocs4ABU0e

pypi mlflow
Moderate
7 months ago

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint GSA_kwCzR0hTQS00NnI1LXg2anEtdjhnNs4ABU0h

pypi mlflow
Critical
7 months ago

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization GSA_kwCzR0hTQS03cWhmLXY2NW0tZzVmM84ABUtB

pypi mlflow
Critical
7 months ago

Mlflow: Command Injection when serving models with enable_mlserver=True GSA_kwCzR0hTQS1ydmhqLThjaGotOHYzY84ABUf4

pypi mlflow
Critical
7 months ago

MLflow Command Injection vulnerability GSA_kwCzR0hTQS1yMjNxLTgyM3Atdm1mN84ABUcb

pypi mlflow
Critical
7 months ago

MLFlow path traversal vulnerability GSA_kwCzR0hTQS12aGN4LTNwcTItNGZ2Y84ABUcW

pypi mlflow
High
8 months ago

MLFlow allows Tracing + Assessments Access GSA_kwCzR0hTQS1nNnBnLTUydmYtODQzaM4ABUYz

pypi mlflow
High
8 months ago

Arbitrary file write via tar traversal in mlflow GSA_kwCzR0hTQS1maGZmLXFtbTgtaDJmcM4ABT1g

pypi mlflow
High
8 months ago

MLflow has a command injection in mlflow/sagemaker/__init__.py GSA_kwCzR0hTQS14Y2gzLTJmOXgtd2g5Zs4ABTqk

pypi mlflow
Critical
9 months ago

MLflow Use of Default Password Authentication Bypass Vulnerability GSA_kwCzR0hTQS1ncTN3LTdqajMteDdncs4ABStG

pypi mlflow
High
9 months ago

MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability GSA_kwCzR0hTQS1xMnI4LXZtcTctZnB4Ms4ABSs6

pypi mlflow
High
9 months ago

mlflow Creates of Temporary File in Directory with Insecure Permissions GSA_kwCzR0hTQS00eDVwLWYzNnItbXh4cs4ABRyv

pypi mlflow
High
10 months ago

MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation GSA_kwCzR0hTQS1wZ3FwLThoNDYtNng0as4ABQ79

pypi mlflow
High
about 1 year ago

MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability GSA_kwCzR0hTQS01Y3ZqLTdyZzYtamdnas4ABN-n

pypi mlflow
High
about 1 year ago

MLflow Weak Password Requirements Authentication Bypass Vulnerability GSA_kwCzR0hTQS02eGo4LXJycXgtcjRjds4ABN-s

pypi mlflow
Moderate
over 1 year ago

MLFlow SSRF via gateway_proxy_handler GSA_kwCzR0hTQS13eGo3LTNmeDUtcHA5bc4ABJW7

pypi mlflow
Low
over 1 year ago

MLflow has Weak Password Requirements GSA_kwCzR0hTQS00cmoyLTlnY3gtNXFoeM4ABFvl

pypi mlflow
Moderate
over 1 year ago

MLflow Cross-Site Request Forgery (CSRF) vulnerability GSA_kwCzR0hTQS05Njl3LWdxcXItZzZqM84ABFv4

pypi mlflow
Moderate
over 1 year ago

MLflow Uncontrolled Resource Consumption vulnerability GSA_kwCzR0hTQS00OW02LXZycjktMmNxbc4ABFvt

pypi mlflow
High
over 1 year ago

MLflow has a Local File Read/Path Traversal in dbfs GSA_kwCzR0hTQS00cnFmLThwZm0tcDM2cs4ABFs3

pypi mlflow
Moderate
over 1 year ago

MLflow Uncontrolled Resource Consumption vulnerability GSA_kwCzR0hTQS1xM2d3LTgyMzYtNWp3NM4ABFsO

pypi mlflow
High
almost 2 years ago

MLflow's excessive directory permissions allow local privilege escalation GSA_kwCzR0hTQS1xcGdjLXc0bWctNnY5Ms4ABBvR

pypi mlflow
Moderate
over 2 years ago

Undefined Behavior in mlflow GSA_kwCzR0hTQS04ZjhxLXEyajctN2oybc4AA8w-

pypi mlflow
High
over 2 years ago

Local File Inclusion in mlflow GSA_kwCzR0hTQS1qNDZxLTVweHgtOHZtd84AA8xl

pypi mlflow
Critical
over 2 years ago

Remote code execution in mlflow GSA_kwCzR0hTQS01cTZjLWZmdmcteGNtOc4AA8xf

pypi mlflow
High
over 2 years ago

MLFlow improper input validation GSA_kwCzR0hTQS1wcWN2LXF3MnItcjg1Oc4AA8rt

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS1qOG1nLXBxYzUteDlnas4AA8rn

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS1jd2dnLXc2bXAtdzloZ84AA8rp

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS13ZjdmLThmeGYteGZ4Y84AA8ro

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS1jdjZjLTc5NjMtd3hjZ84AA8rv

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS03NmNnLWNmaHgtMzczZs4AA8rk

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS00M2M0LTlxZ2oteDc0Ms4AA8re

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS1naHY2LTlyOWotd2g0as4AA8rm

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS14Mzh4LWc2Z3ItanFmZs4AA8rl

pypi mlflow
High
over 2 years ago

MLFlow unsafe deserialization GSA_kwCzR0hTQS03cDhqLXF2NngtZjRnNM4AA8rh

pypi mlflow
Moderate
over 2 years ago

MLflow allows low privilege users to delete any artifact GSA_kwCzR0hTQS1wNGp4LXE2MnAteDVqcs4AA8J5

pypi mlflow
High
over 2 years ago

MLflow has a Local File Read/Path Traversal bypass GSA_kwCzR0hTQS1yZnFxLXdxNnctNzJqbc4AA8J7

pypi mlflow
Critical
over 2 years ago

mlflow vulnerable to Path Traversal GSA_kwCzR0hTQS1ocTg4LXdnN3EtZ3A0Z84AA7CC

pypi mlflow
High
over 2 years ago

mlflow vulnerable to Path Traversal GSA_kwCzR0hTQS1qNjJyLXd4cXEtZjNnZs4AA7B4

pypi mlflow
High
over 2 years ago

mlflow vulnerable to Path Traversal GSA_kwCzR0hTQS01bXZqLXdtZ2otN3E4Y84AA7CR

pypi mlflow
High
over 2 years ago

mlflow vulnerable to Path Traversal GSA_kwCzR0hTQS1mNDJtLW12ZnYtY2d3Nc4AA7B7

pypi mlflow
High
over 2 years ago

mlflow vulnerable to Path Traversal GSA_kwCzR0hTQS1tNDljLTVjNTItNjY5Ns4AA7B8

pypi mlflow
High
over 2 years ago

mlflow Path Traversal vulnerability GSA_kwCzR0hTQS1mODJyLWpqNXItNmc5N84AA7CM

pypi mlflow
Critical
over 2 years ago

MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution GSA_kwCzR0hTQS0zdjc5LXE3cGgtajc1aM4AA5e3

pypi mlflow
Critical
over 2 years ago

Cross-site Scripting in MLFlow GSA_kwCzR0hTQS02NzQ5LW01Y3AtNmNnN84AA5e2

pypi mlflow
Critical
almost 3 years ago

MLFlow Path Traversal Vulnerability GSA_kwCzR0hTQS1oaDhwLXA4bXAtZ3Fobc4AA37i

pypi mlflow
High
almost 3 years ago

MLflow Local File Disclosure Vulnerability GSA_kwCzR0hTQS1xZzhwLTMyZ3ItZ2g2eM4AA37h

pypi mlflow
Critical
almost 3 years ago

MLflow Server-Side Request Forgery (SSRF) GSA_kwCzR0hTQS01OXYzLTg5OHItcXdoas4AA37g

pypi mlflow
High
almost 3 years ago

MLflow Path Traversal Vulnerability GSA_kwCzR0hTQS13djhxLTRmODUtMnA4cM4AA37f

pypi mlflow
High
almost 3 years ago

MLflow Path Traversal Vulnerability GSA_kwCzR0hTQS01cjNxLTkzcTMtZjk3OM4AA37c

pypi mlflow
High
almost 3 years ago

mlflow Command Injection vulnerability GSA_kwCzR0hTQS1odmM2LTQydmYtamhmOM4AA35I

pypi mlflow
Critical
almost 3 years ago

Path traversal in MLflow GSA_kwCzR0hTQS01NTR3LXhoNGotOHc2NM4AA3yh

pypi mlflow
High
almost 3 years ago

Path traversal in MLflow GSA_kwCzR0hTQS12OTQ1LXIzcmMtNmZqbc4AA3ti

pypi mlflow
High
almost 3 years ago

Jinja2 template injection in mlflow GSA_kwCzR0hTQS1jeGZyLTVxM3ItMnJjMs4AA3r7

pypi mlflow
Moderate
almost 3 years ago

Cross-site Scripting (XSS) in MLflow GSA_kwCzR0hTQS12d2hmLTN2Nngtd2ZmOM4AA3mS

pypi mlflow
High
almost 3 years ago

Information exposure in MLflow GSA_kwCzR0hTQS13cXhmLTQ0N20tNmY1Zs4AA3kN

pypi mlflow
Critical
almost 3 years ago

MLflow authentication requirement bypass can allow a user to arbitrarily create an account GSA_kwCzR0hTQS00cXE1LW14eHgtbTZnZ84AA3Oh

pypi mlflow
Critical
almost 3 years ago

Remote Code Execution due to Full Controled File Write in mlflow GSA_kwCzR0hTQS01cDNoLTdmd2gtOTJyY84AA3OR

pypi mlflow
Critical
almost 3 years ago

MLflow allowed arbitrary files to be PUT onto the server GSA_kwCzR0hTQS1mNzk4LXFtNHItMjNyNc4AA3ON

pypi mlflow
High
over 3 years ago

mlflow vulnerable to OS Command Injection GSA_kwCzR0hTQS1mZnczLTYzNzgtY3FncM4AA0-f

pypi mlflow
Critical
over 3 years ago

MLflow Path Traversal vulnerability GSA_kwCzR0hTQS1mbXhqLTZoOWctNnZ3M84AA0y8

pypi mlflow
Critical
over 3 years ago

mlflow Path Traversal vulnerability GSA_kwCzR0hTQS13anEzLTdqeHgtd2hqOc4AAzYV

pypi mlflow
High
over 3 years ago

mflow vulnerable to directory traversal GSA_kwCzR0hTQS13YzZqLTVnODMteGZtNs4AAzRj

pypi mlflow
Critical
over 3 years ago

Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs GSA_kwCzR0hTQS04M2ZtLXc3OW0tNjRyNc4AAzCj

pypi mlflow
High
over 3 years ago

Relative path traversal in mlflow GSA_kwCzR0hTQS14NDIyLTZxaHYtcDI5Z84AAzAd

pypi mlflow
Moderate
over 3 years ago

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs GSA_kwCzR0hTQS13cDcyLTdoajktNTI2Nc4AAyUI

pypi mlflow
Critical
over 3 years ago

mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs GSA_kwCzR0hTQS14ZzczLTk0ZnAtZzQ0Oc4AAyUH

pypi mlflow
High
over 4 years ago

Insecure Temporary File in mlflow GSA_kwCzR0hTQS12cWoyLTR2OG0tOHZycc0uPQ

pypi mlflow

Match affected ranges for this package. Potential advisories inferred from related packages are excluded.

Filter by Severity

High 47 Critical 24 Moderate 14 Low 2