9.1
Critical
CVE-2023-6014 An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment
Description
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mlflow/mlflow | Versions not published | |
| MLflow | Versions not published |
Other CVEs of mlflow/mlflow
The 55 CVEs of mlflow/mlflow →
CVE-2026-8147
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper…
8.1
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI…
9.1
Critical
CVE-2026-3198
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API…
6.5
Medium
CVE-2026-2651
A vulnerability in MLflow…
9.0
Critical