CVE-2025-11201High· 8.1▾ Abyssal0dayPoC availableMLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 44.6 · likelihood 5.3 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
27%
1 GitHub repo
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
mlflow >= 3.0.0rc0, < 3.0.0mlflow < 2.22.4Upgrade to a patched release:
mlflow 3.0.0mlflow 2.22.4Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64849Critical· 9.3MLflow is an open source AI engineering platform for agents, large language models, and machine learning models
CVE-2026-71211High· 7.1MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim
CVE-2026-0545Critical· 9.8In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled
CVE-2026-2652High· 8.6MLflow: unauthenticated access to certain FastAPI routes
CVE-2023-43472High· 7.5Information exposure in MLflow
CVE-2023-6977High· 7.5MLflow Local File Disclosure Vulnerability