CVE-2024-8859High· 7.5▾ MidnightPoC availableMLflow has a Local File Read/Path Traversal in dbfs
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.6 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.6%
Nuclei ×1
2.6% → 2.8%
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.
mlflow < 2.17.0rc0Upgrade to a patched release:
mlflow 2.17.0rc0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116692Critical· 9.8MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed arti…
CVE-2026-115886Medium· 6.5MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
CVE-2026-64849Critical· 9.3MLflow is an open source AI engineering platform for agents, large language models, and machine learning models
CVE-2026-71211High· 7.1MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim
CVE-2026-0545Critical· 9.8In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled
CVE-2026-2652High· 8.6MLflow: unauthenticated access to certain FastAPI routes