MLflow has 54 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 12 in the last 90 days against 8 in the 90 before. The busiest recent month was May 2026 with 5. The median CVSS is 8.1 (high), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-502 (4) and CWE-22 (3).

CVEs per month

Last 12 months, by publish date

1225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/101126/11

Exploited share: 0% vs 1% corpus
Median CVSS: 8.1
Publish → KEV: —
Last 90 days: 12 prev 8

Weakness classes

Products

mlflow 54

Follow MLflow:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

MLflow vulnerabilities

CVEs affecting MLflow, newest first. Open any entry for full detail, references, and exploit status.

54 CVEsRSS

CVE-2024-6838Medium· 5.3

1y ago

CVEs per month

Weakness classes

Products

Worst active — by depth score

MLflow vulnerabilities

MLflow Uncontrolled Resource Consumption vulnerability

MLflow Cross-Site Request Forgery (CSRF) vulnerability

MLflow has a Local File Read/Path Traversal in dbfs

MLflow Uncontrolled Resource Consumption vulnerability

Undefined Behavior in mlflow

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow improper input validation

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

MLFlow unsafe deserialization

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

mlflow Path Traversal vulnerability

mlflow vulnerable to Path Traversal

mlflow vulnerable to Path Traversal

MLflow Path Traversal Vulnerability

MLflow Local File Disclosure Vulnerability

mlflow Command Injection vulnerability

Information exposure in MLflow