CVE-2026-2611Critical· 9.6▾ MidnightIn MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact wit…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
mlflow >= 3.9.0, < 3.10.0Upgrade past the affected range:
mlflow 3.10.0Affected packages:
mlflow >= 3.9.0, < 3.10.0Patched in:
mlflow 3.10.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-64849Critical· 9.3MLflow is an open source AI engineering platform for agents, large language models, and machine learning models
CVE-2026-71211High· 7.1MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim
CVE-2026-116691Medium· 6.5MLflow CrewAI autologging records LLM provider API keys in logged trace spans
CVE-2026-116692Critical· 9.8MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed arti…
CVE-2026-115886Medium· 6.5MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
CVE-2025-15036Critical· 9.6MLFlow path traversal vulnerability