MLflow vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 202319
3. 202421
4. 20257
5. 202641

Known exploitedNewest addition to KEV first

• CVE-2026-64849

  MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

  mlflow · mlflow

  ExploitedCritical9.3

Newest CVEs

• CVE-2026-118628

  MLflow get-artifacts Server-Side Request Forgery Information Disclosure Vulnerability

  MLflow · MLflow

  High8.2
• CVE-2026-118627

  MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution Vulnerability

  MLflow · MLflow

  High7.8
• CVE-2026-118626

  MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability

  MLflow · MLflow

  Medium5.4
• CVE-2026-118625

  MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability

  MLflow · MLflow

  Medium6.3
• CVE-2026-118624

  MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability

  MLflow · MLflow

  Medium5.4
• CVE-2026-118623

  MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability

  MLflow · MLflow

  High7.8
• CVE-2026-116692

  MLflow: Remote code execution on unauthenticated MLflow servers via third-party scorer deserialization importing caller-placed artifact modules

  mlflow · mlflow

  Critical9.8
• CVE-2026-116691

  MLflow CrewAI autologging records LLM provider API keys in logged trace spans

  mlflow · mlflow

  Medium6.5
• CVE-2026-116690

  MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source

  mlflow · mlflow

  High7.5
• CVE-2026-115886

  MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

  mlflow · mlflow

  Medium6.5