CVE-2024-3099Medium· 5.4▾ SunlitUndefined Behavior in mlflow
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.
mlflow < 2.11.3Upgrade to a patched release:
mlflow 2.11.3Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116691Medium· 6.5MLflow CrewAI autologging records LLM provider API keys in logged trace spans
CVE-2026-116692Critical· 9.8MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed arti…
CVE-2026-115886Medium· 6.5MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
CVE-2026-2611Critical· 9.6In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints
CVE-2025-15036Critical· 9.6MLFlow path traversal vulnerability
CVE-2026-33866Medium· 4.3MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint