lfprojects Vulnerabilities and Affected Products
Explore source-attributed vulnerabilities associated with lfprojects products.
Products
- mlflow23 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-2652HIGH | Authentication Bypass in mlflow/mlflowA vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to su… | CVSS8.6v3.0 | EPSS18.9% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2025-52967MEDIUM | MLFlow SSRF via gateway_proxy_handlergateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation. CWE-918Jun 23, 2025 | CVSS5.8v3.1 | EPSS0.37% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udfExcessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called. | CVSS-v4.0 | EPSS0.121% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-2928HIGH | Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflowA Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previou… | CVSS7.5v3.1 | EPSS21.8% | PoCs2 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-3099MEDIUM | Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflowA vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using th… CWE-475Jun 6, 2024 | CVSS5.4v3.1 | EPSS0.438% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37061HIGH | MLFlow improper input validationRemote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLproject to execute arbitrary code on an end user’s system when run. | CVSS8.8v3.1 | EPSS0.884% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37060HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.769% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37058HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.618% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37057HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.618% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37056HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.618% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37055HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.618% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37054HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.703% | PoCs6 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37053HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.618% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37052HIGH | MLFlow unsafe deserializationDeserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with. CWE-502Jun 4, 2024 | CVSS8.8v3.1 | EPSS0.618% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-3848HIGH | Path Traversal Bypass in mlflow/mlflowA path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitra… | CVSS7.5v3.1 | EPSS43.3% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
CVE-2024-3573CRITICAL | Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflowmlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least … | CVSS9.3v3.1 | EPSS0.733% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1558HIGH | Path Traversal Vulnerability in mlflow/mlflowA path traversal vulnerability exists in the `_create_model_version()` function within `server/handlers.py` of the mlflow/mlflow repository, due to improper validation of the `source` parameter. Attackers can exploit this vulnerability by crafting a `source` parameter that bypasses the `_validate_non_local_source_contains_relative_paths(source)` function's checks, allowing for arbitrary file read access on the server. The issue arises from the handling of unquoted URL characters and the subseque… CWE-22Apr 16, 2024 | CVSS7.5v3.1 | EPSS0.859% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-1594HIGH | Local File Read via Path Traversal in mlflow/mlflowA path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the `artifact_location` parameter when creating an experiment. Attackers can exploit this vulnerability by using a fragment component `#` in the artifact location URI to read arbitrary files on the server in the context of the server's process. This issue is similar to CVE-2023-6909 but utilizes a different component of the URI to achieve the same effect. CWE-22Apr 16, 2024 | CVSS7.5v3.1 | EPSS0.712% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-27133HIGH | Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields. CWE-79Feb 23, 2024 | CVSS7.5v3.1 | EPSS0.656% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-27132HIGH | Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables. CWE-79Feb 23, 2024 | CVSS7.5v3.1 | EPSS0.878% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Path Traversal: '\..\filename' in mlflow/mlflowPath Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. | CVSS-v4.0 | EPSS89.7% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX | |
CVE-2023-3765CRITICAL | Absolute Path Traversal in mlflow/mlflowAbsolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. | CVSS10.0v3.1 | EPSS67.6% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |
Path Traversal: '\..\filename' in mlflow/mlflowPath Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. | CVSS-v4.0 | EPSS69.7% | PoCs5 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |