Known Vulnerabilities for Mlflow by Lfprojects
Listed below are 10 of the newest known vulnerabilities associated with "Mlflow" by "Lfprojects".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-33866 json | Not Provided | 2026-04-07 | 2026-04-20 | |
| CVE-2026-33865 json | Not Provided | 2026-04-07 | 2026-04-20 | |
| CVE-2026-13484 json | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown f... | Not Provided | 2026-06-28 | 2026-06-30 |
| CVE-2026-10803 json | A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/dat... | Not Provided | 2026-06-04 | 2026-06-04 |
| CVE-2026-8147 json | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorizati... | Not Provided | 2026-07-02 | 2026-07-02 |
| CVE-2026-4137 json | In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates... | Not Provided | 2026-05-18 | 2026-05-19 |
| CVE-2026-4035 json | A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway se... | Not Provided | 2026-06-03 | 2026-07-15 |
| CVE-2026-3198 json | MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API 'list' ... | Not Provided | 2026-06-02 | 2026-06-02 |
| CVE-2026-2734 json | In mlflow/mlflow versions up to 3.9.0, the `SearchModelVersions` REST API endpoint and the `mlflowSearchModelVersions` GraphQ... | Not Provided | 2026-05-21 | 2026-05-21 |
| CVE-2026-2652 json | A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the ... | Not Provided | 2026-05-15 | 2026-05-15 |