LLM frameworks · Databricks (open source, Linux Foundation)
MLflow
Open-source platform for tracking, evaluating and serving ML models and GenAI apps, including LLM tracing and evaluation.
5Advisories
1critical
2high
2medium
2026-11-12Latest
Timeline · advisories per quarter
52026 Q4
Named in sources
Reported for MLflow
01. CVE-2026-116692: MLflow 3.17.0 fixes unauthenticated code execution through third-party scorers, an arbitrary file read through prompt versions, and CrewAI API keys leaking into tracesThree MLflow advisories were published on 27 October 2026, all fixed in MLflow 3.17.0. The worst lets anyone who can reach a default no-auth MLflow server upload a Python file as a run artifact and get the server to import and run it through the third-party scorer endpoint. A second lets a caller read any file the server can read by creating a prompt version with a relative source path. The third makes mlflow.crewai.autolog() write CrewAI LLM API keys into trace spans. Upgrade to 3.17.0. MLflow 2026-10-27 02. CVE-2026-118628 and five more: MLflow before 3.17.0 has an unauthenticated SSRF in get-artifacts, two unsafe-deserialization code execution bugs and three missing permission checks, upgrade to 3.17.0Trend Micro's Zero Day Initiative published six MLflow advisories on 29 October 2026 (CVEs added to NVD on 4 November). The worst lets an unauthenticated attacker abuse the get-artifacts function, which does not validate a URI before accessing it, to disclose information from the server. Two more turn a malicious SHAP explainer or pickle evaluation artifact into code execution when someone loads it, and three let logged-in users reach Tracking Server functions they should not have access to. All are fixed by MLflow 3.17.0. MLflow 2026-10-29 03. CVE-2026-53995: MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystemMLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. MLflow 2026-10-19 04. CVE-2026-127202: MLflow FileStore lets unauthenticated callers write outside the run directory via model_id in log_outputs, fixed in 3.18.0MLflow tracking servers before 3.18.0 that use the FileStore backend join the model_id from POST /api/3.0/mlflow/runs/outputs into a path without checking it. An unauthenticated caller can send ../ sequences to create directories and write a meta.yaml file anywhere the server account can write. Upgrade to 3.18.0. MLflow 2026-11-12 05. CVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRFMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. MLflow 2026-10-23
MLflow 2026-10-27 02. CVE-2026-118628 and five more: MLflow before 3.17.0 has an unauthenticated SSRF in get-artifacts, two unsafe-deserialization code execution bugs and three missing permission checks, upgrade to 3.17.0Trend Micro's Zero Day Initiative published six MLflow advisories on 29 October 2026 (CVEs added to NVD on 4 November). The worst lets an unauthenticated attacker abuse the get-artifacts function, which does not validate a URI before accessing it, to disclose information from the server. Two more turn a malicious SHAP explainer or pickle evaluation artifact into code execution when someone loads it, and three let logged-in users reach Tracking Server functions they should not have access to. All are fixed by MLflow 3.17.0. MLflow 2026-10-29 03. CVE-2026-53995: MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystemMLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. MLflow 2026-10-19 04. CVE-2026-127202: MLflow FileStore lets unauthenticated callers write outside the run directory via model_id in log_outputs, fixed in 3.18.0MLflow tracking servers before 3.18.0 that use the FileStore backend join the model_id from POST /api/3.0/mlflow/runs/outputs into a path without checking it. An unauthenticated caller can send ../ sequences to create directories and write a meta.yaml file anywhere the server account can write. Upgrade to 3.18.0. MLflow 2026-11-12 05. CVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRFMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. MLflow 2026-10-23