Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

mlflow Security Vulnerabilities | CyStack CVE Database

CVE	Exploitation status	Fix	Affected product	Published	Severity
`CVE-2026-79721`CVE-2026-79721	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published09/08/2026	SeverityHigh
`CVE-2026-69146`MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth	Exploitation statusPublic exploit	FixYes	Affected productMLflow	Published08/17/2026	SeverityMedium
`CVE-2026-69148`MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id	Exploitation statusPublic exploit	FixYes	Affected productMLflow	Published08/17/2026	SeverityHigh
`CVE-2026-64849`MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)	Exploitation statusKEV	FixYes	Affected productMLflow	Published08/17/2026	SeverityCritical
`CVE-2026-71211`mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published08/05/2026	SeverityHigh
`CVE-2026-8147`Authorization Bypass in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published07/02/2026	SeverityHigh
`CVE-2026-4035`Environment Variable Resolution Vulnerability in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published06/03/2026	SeverityCritical
`CVE-2026-3198`Improper Access Control in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published06/02/2026	SeverityMedium
`CVE-2026-2651`Missing Authorization Validation in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/25/2026	SeverityCritical
`CVE-2026-2734`Authorization Bypass in SearchModelVersions in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/21/2026	SeverityMedium
`CVE-2026-2611`Improper Origin Validation in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/19/2026	SeverityCritical
`CVE-2026-4137`Incomplete Fix for CVE-2025-10279: Insecure Temporary Directory Permissions in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/18/2026	SeverityHigh
`CVE-2026-2652`Authentication Bypass in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/15/2026	SeverityHigh
`CVE-2026-2614`Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/11/2026	SeverityHigh
`CVE-2026-2393`Server-Side Request Forgery (SSRF) in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/11/2026	SeverityHigh
`CVE-2026-33866`Authorization Bypass in MLflow AJAX Endpoint	Exploitation statusPublic exploit	FixYes	Affected productMLflow	Published04/07/2026	SeverityMedium
`CVE-2026-33865`Stored XSS via unsafe YAML parsing in MLflow	Exploitation statusPublic exploit	FixYes	Affected productMLflow	Published04/07/2026	SeverityMedium
`CVE-2026-0545`Missing Authentication for Critical Function in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published04/03/2026	SeverityCritical
`CVE-2026-0596`Command Injection in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published03/31/2026	SeverityCritical
`CVE-2025-15379`Command Injection in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published03/30/2026	SeverityCritical
`CVE-2025-15036`Path Traversal Vulnerability in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published03/30/2026	SeverityCritical
`CVE-2025-15381`Unauthorized Access to Tracing and Assessment Endpoints in mlflow/mlflow	Exploitation statusNot known exploited	FixNot confirmed	Affected productmlflow/mlflow	Published03/27/2026	SeverityHigh
`CVE-2025-15031`Path Traversal Vulnerability in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published03/18/2026	SeverityHigh
`CVE-2025-14287`Command Injection in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published03/15/2026	SeverityHigh
`CVE-2026-2635`MLflow Use of Default Password Authentication Bypass Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published02/20/2026	SeverityCritical
`CVE-2026-2033`MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published02/20/2026	SeverityHigh
`CVE-2025-10279`Privilege Escalation in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published02/02/2026	SeverityHigh
`CVE-2025-14279`DNS Rebinding Vulnerability in mlflow/mlflow	Exploitation statusNot known exploited	FixYes	Affected productmlflow/mlflow	Published01/12/2026	SeverityHigh
`CVE-2025-11200`MLflow Weak Password Requirements Authentication Bypass Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published10/29/2025	SeverityHigh
`CVE-2025-11201`MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published10/29/2025	SeverityHigh
`CVE-2025-0453`Denial of Service through Batched Queries in GraphQL in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published03/20/2025	SeverityMedium
`CVE-2025-1474`Weak Password Requirements in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published03/20/2025	SeverityLow
`CVE-2025-1473`CSRF in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published03/20/2025	SeverityMedium
`CVE-2024-8859`Path Traversal in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published03/20/2025	SeverityHigh
`CVE-2024-6838`Uncontrolled Resource Consumption in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published03/20/2025	SeverityMedium
`CVE-2024-2928`Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow	Exploitation statusNot known exploited	FixYes	Affected productmlflow/mlflow	Published06/06/2024	SeverityHigh
`CVE-2024-0520`Remote Code Execution due to Full Controlled File Write in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published06/06/2024	SeverityCritical
`CVE-2024-3099`Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published06/06/2024	SeverityMedium
`CVE-2024-37061`CVE-2024-37061	Exploitation statusPublic exploit	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37060`CVE-2024-37060	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37059`CVE-2024-37059	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37058`CVE-2024-37058	Exploitation statusPublic exploit	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37057`CVE-2024-37057	Exploitation statusPublic exploit	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37056`CVE-2024-37056	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37055`CVE-2024-37055	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37054`CVE-2024-37054	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37053`CVE-2024-37053	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-37052`CVE-2024-37052	Exploitation statusNot known exploited	FixNot confirmed	Affected productMLflow	Published06/04/2024	SeverityHigh
`CVE-2024-4263`Improper Access Control in mlflow/mlflow	Exploitation statusNot known exploited	FixYes	Affected productmlflow/mlflow	Published05/16/2024	SeverityMedium
`CVE-2024-3848`Path Traversal Bypass in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/16/2024	SeverityHigh
`CVE-2024-3573`Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published04/16/2024	SeverityCritical
`CVE-2024-1558`Path Traversal Vulnerability in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published04/16/2024	SeverityHigh
`CVE-2024-1594`Local File Read via Path Traversal in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published04/16/2024	SeverityHigh
`CVE-2024-1593`Path Traversal via Parameter Smuggling in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published04/16/2024	SeverityHigh
`CVE-2024-1483`Path Traversal Vulnerability in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published04/16/2024	SeverityHigh
`CVE-2024-1560`Path Traversal Vulnerability in mlflow/mlflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published04/16/2024	SeverityHigh
`CVE-2023-6977`Path Traversal: '\..\filename'	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published12/20/2023	SeverityCritical
`CVE-2023-6976`Unrestricted Upload of File with Dangerous Type	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published12/20/2023	SeverityHigh
`CVE-2023-6975`Path Traversal: '\..\filename'	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published12/20/2023	SeverityCritical
`CVE-2023-6974`Server-Side Request Forgery (SSRF)	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published12/20/2023	SeverityHigh
`CVE-2023-6940`Command Injection	Exploitation statusNot known exploited	FixYes	Affected productmlflow/mlflow	Published12/19/2023	SeverityCritical
`CVE-2023-6909`Path Traversal: '\..\filename' in mlflow/mlflow	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published12/18/2023	SeverityHigh
`CVE-2023-6831`Path Traversal: '\..\filename' in mlflow/mlflow	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published12/15/2023	SeverityHigh
`CVE-2023-6753`Path Traversal in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published12/13/2023	SeverityCritical
`CVE-2023-6709`Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published12/12/2023	SeverityCritical
`CVE-2023-6568`Reflected XSS via Content-Type Header in mlflow/mlflow	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published12/07/2023	SeverityMedium
`CVE-2023-6014`MLflow Authentication Bypass	Exploitation statusPublic exploit	FixNot confirmed	Affected productmlflow/mlflow	Published11/16/2023	SeverityCritical
`CVE-2023-6015`MLflow Arbitrary File Upload	Exploitation statusNot confirmed	FixNot confirmed	Affected productmlflow/mlflow	Published11/16/2023	SeverityCritical
`CVE-2023-6018`MLflow Arbitrary File Write	Exploitation statusNot confirmed	FixNot confirmed	Affected productmlflow/mlflow	Published11/16/2023	SeverityCritical
`CVE-2023-4033`OS Command Injection in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published08/01/2023	SeverityHigh
`CVE-2023-3765`Absolute Path Traversal in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published07/19/2023	SeverityCritical
`CVE-2023-2780`Path Traversal: '\..\filename' in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published05/17/2023	SeverityCritical
`CVE-2023-2356`Relative Path Traversal in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published04/28/2023	SeverityCritical
`CVE-2023-1177`Path Traversal: '\..\filename' in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published03/24/2023	SeverityCritical
`CVE-2023-1176`Absolute Path Traversal in mlflow/mlflow	Exploitation statusPublic exploit	FixYes	Affected productmlflow/mlflow	Published03/24/2023	SeverityMedium
`CVE-2022-0736`Insecure Temporary File in mlflow/mlflow	Exploitation statusNot confirmed	FixYes	Affected productmlflow/mlflow	Published02/23/2022	SeverityHigh

76 / 76 Results

All vulnerabilities loaded

Security vulnerabilities from mlflow

mlflow

How many security vulnerabilities does mlflow have?

Which mlflow product has the most security vulnerabilities?

Run an in-depth assessment with complete web risk management

Popular mlflow products

mlflow/mlflow

MLflow