en
MLflow is an open-source AI engineering platform for agents, large language models, and machine-learning models. It provides capabilities for observability, evaluation, experiment tracking, prompt management, model registry, deployment, and monitoring. It is intended for engineering teams, researchers, and organizations building and operating AI applications, and is maintained through a global open-source community.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
As of 10/22/2026, mlflow recorded 8 security vulnerabilities in the last 90 days across 1 products, including 7 rated High or above and 1 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, mlflow had the most security vulnerabilities in the mlflow ecosystem, with 8 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CVE-2026-53995MLflow 3.17.1 and prior Path Traversal via Trace ID APICVE-2026-96804CVE-2026-96804CVE-2026-96775MLflow dspy bypasses pickle deserialization controlCVE-2026-79721CVE-2026-79721CVE-2026-69146MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth79 Results | Page 1 of 8
| SeverityHigh |
| SeverityMedium |
| SeverityHigh |
| SeverityCritical |
| SeverityHigh |
| SeverityHigh |
| SeverityCritical |