VulnerableCode Package Details - pkg:pypi/mlflow@2.16.0

Search for packages

Vulnerability	Summary	Fixed by
VCID-cu1t-7wnm-y7hk Aliases: CVE-2026-33866 PYSEC-2026-94	MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.10.1	3.11.0rc0 Affected by 0 other vulnerabilities.
VCID-g9p5-4cqv-qfew Aliases: CVE-2026-33865 PYSEC-2026-93	MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. This issue affects MLflow version through 3.10.1	3.11.0rc0 Affected by 0 other vulnerabilities.
VCID-hz26-bm34-gkfx Aliases: CVE-2025-1474 PYSEC-2025-17	In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.	2.19.0 Affected by 3 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-rcqb-2498-77e2 Aliases: CVE-2025-52967 PYSEC-2025-52	gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.	3.1.0 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerability

Summary

Fixed by

VCID-cu1t-7wnm-y7hk
Aliases:
CVE-2026-33866
PYSEC-2026-94

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access. This issue affects MLflow version through 3.10.1

3.11.0rc0
Affected by 0 other vulnerabilities.

VCID-g9p5-4cqv-qfew
Aliases:
CVE-2026-33865
PYSEC-2026-93

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. This issue affects MLflow version through 3.10.1

3.11.0rc0
Affected by 0 other vulnerabilities.

VCID-hz26-bm34-gkfx
Aliases:
CVE-2025-1474
PYSEC-2025-17

In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as accounts without passwords may be susceptible to unauthorized access. Additionally, this issue violates best practices for secure user account management. The issue is fixed in version 2.19.0.

2.19.0
Affected by 3 other vulnerabilities.

VCID-rcqb-2498-77e2
Aliases:
CVE-2025-52967
PYSEC-2025-52

gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.

3.1.0
Affected by 2 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-syg7-c85s-4ufu	Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.	CVE-2024-27134 PYSEC-2024-224

Vulnerability

Summary

Aliases

VCID-syg7-c85s-4ufu

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

CVE-2024-27134
PYSEC-2024-224

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:24:31.710305+00:00	Pypa Importer	Affected by	VCID-cu1t-7wnm-y7hk	https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2026-94.yaml	38.6.0
2026-06-02T04:24:30.968817+00:00	Pypa Importer	Affected by	VCID-g9p5-4cqv-qfew	https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2026-93.yaml	38.6.0
2026-06-02T04:23:14.465326+00:00	Pypa Importer	Affected by	VCID-rcqb-2498-77e2	https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2025-52.yaml	38.6.0
2026-06-02T04:22:55.310478+00:00	Pypa Importer	Affected by	VCID-hz26-bm34-gkfx	https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2025-17.yaml	38.6.0
2026-06-02T04:22:35.804676+00:00	Pypa Importer	Fixing	VCID-syg7-c85s-4ufu	https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2024-224.yaml	38.6.0