CVE-2026-69148High· 7.1▾ TwilightMLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 18.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
0.2% → 0.4%
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mlflow < 3.15.0Patched in:
mlflow 3.15.0Source: https://github.com/advisories/GHSA-gqch-g4w5-7qcw
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-69146Medium· 6.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models
CVE-2026-53995High· 8.2MLflow 3.17.1 and prior Path Traversal via Trace ID API
CVE-2026-96775High· 8.8MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
CVE-2026-96804High· 8.8MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
CVE-2026-79721High· 8.6Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.
CVE-2026-64849Critical· 9.3MLflow is an open source AI engineering platform for agents, large language models, and machine learning models