CVE-2026-33866Medium· 4.3▾ SunlitMLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.4%
MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑control validation, a user without permissions to a given experiment can directly query this endpoint and retrieve model artifacts they are not authorized to access.
This issue affects MLflow version through 3.10.1
mlflow < 3.11.0rc0Upgrade to a patched release:
mlflow 3.11.0rc0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116691Medium· 6.5MLflow CrewAI autologging records LLM provider API keys in logged trace spans
CVE-2026-116692Critical· 9.8MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed arti…
CVE-2026-115886Medium· 6.5MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
CVE-2026-2611Critical· 9.6In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints
CVE-2025-15036Critical· 9.6MLFlow path traversal vulnerability
CVE-2025-15379Critical· 10.0A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function