---
id: CVE-2026-10803
title: >-
  mlflow: MLflow: Use of weak hash in Dataset Digest Computation
  (CVE-2026-10803)
summary: >-
  A flaw was found in MLflow. This vulnerability stems from the use of a weak
  hash algorithm within the Dataset Digest Computation component. A local
  attacker could potentially exploit this weakness, which may impact the
  integrity or authent…
severity: low
cvss: 2.5
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: vendor
cwe: CWE-328
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - openshift_ai_rhoai
patched:
  - mlflow 3.10.1
published: '2026-06-04'
updated: '2026-09-28'
sourceUpdated: '2026-09-28T05:26:37+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10803.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10803.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-10803'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2484755'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-10803'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10803'
  - url: 'https://github.com/mlflow/mlflow/'
  - url: 'https://github.com/mlflow/mlflow/issues/22419'
  - url: 'https://github.com/mlflow/mlflow/pull/22420'
  - url: 'https://vuldb.com/cve/CVE-2026-10803'
  - url: 'https://vuldb.com/submit/831462'
  - url: 'https://vuldb.com/vuln/368252'
  - url: 'https://vuldb.com/vuln/368252/cti'
  - url: 'https://github.com/mlflow/mlflow'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-195.yaml
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00103
epssPercentile: 0.00966
aliases:
  - GHSA-5qmp-p3c4-72qj
  - BIT-mlflow-2026-10803
  - PYSEC-2026-195
ecosystem: pip
scores:
  vendor: 2.5
  osv: 3.6
ingestedAt: '2026-07-16T18:59:41.471Z'
---

## Overview

A flaw was found in MLflow. This vulnerability stems from the use of a weak hash algorithm within the Dataset Digest Computation component. A local attacker could potentially exploit this weakness, which may impact the integrity or authenticity of data. Exploitation is considered difficult due to high complexity.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-10803.json)

**mlflow: MLflow: Use of weak hash in Dataset Digest Computation** — rated Low by Red Hat. Released 2026-06-04, updated 2026-09-28.

Affected:

- Red Hat OpenShift AI (RHOAI)

No fix planned:

- Red Hat OpenShift AI (RHOAI)

## Remediation

Fix deferred

## Package advisory (CVE-2026-10803)

Affected packages:

- `mlflow < 3.10.1`

Patched in:

- `mlflow 3.10.1`

Source: https://osv.dev/vulnerability/GHSA-5qmp-p3c4-72qj