| Affected_by_vulnerabilities |
| 0 |
| url |
VCID-7m3u-tyeh-rqgz |
| vulnerability_id |
VCID-7m3u-tyeh-rqgz |
| summary |
A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This issue arises due to the lack of proper validation for DELETE requests by users with EDIT permissions, allowing them to perform unauthorized deletions of artifacts. The vulnerability specifically affects the handling of artifact deletions within the application, as demonstrated by the ability of a low privilege user to delete a directory inside an artifact using a DELETE request, despite the official documentation stating that users with EDIT permission can only read and update artifacts, not delete them. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-4263, PYSEC-2024-51
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7m3u-tyeh-rqgz |
|
| 1 |
| url |
VCID-cu1t-7wnm-y7hk |
| vulnerability_id |
VCID-cu1t-7wnm-y7hk |
| summary |
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access.
This issue affects MLflow version through 3.10.1 |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33866, PYSEC-2026-94
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cu1t-7wnm-y7hk |
|
| 2 |
| url |
VCID-g9p5-4cqv-qfew |
| vulnerability_id |
VCID-g9p5-4cqv-qfew |
| summary |
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.
This issue affects MLflow version through 3.10.1 |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-33865, PYSEC-2026-93
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g9p5-4cqv-qfew |
|
| 3 |
| url |
VCID-hz26-bm34-gkfx |
| vulnerability_id |
VCID-hz26-bm34-gkfx |
| summary |
In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-1474, PYSEC-2025-17
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hz26-bm34-gkfx |
|
| 4 |
| url |
VCID-jbuf-3rr2-5kcv |
| vulnerability_id |
VCID-jbuf-3rr2-5kcv |
| summary |
A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-2928, PYSEC-2024-242
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jbuf-3rr2-5kcv |
|
| 5 |
| url |
VCID-pzmb-xzk9-s7dy |
| vulnerability_id |
VCID-pzmb-xzk9-s7dy |
| summary |
A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-3848, PYSEC-2024-244
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pzmb-xzk9-s7dy |
|
| 6 |
|
| 7 |
| url |
VCID-syg7-c85s-4ufu |
| vulnerability_id |
VCID-syg7-c85s-4ufu |
| summary |
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-27134, PYSEC-2024-224
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-syg7-c85s-4ufu |
|
|
|---|