8.8
High
CVE-2023-6976 This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the…
Description
This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mlflow/mlflow 2.9 | earliest → < 2.9.2 | 2.9.2 |
Other CVEs of mlflow/mlflow
The 55 CVEs of mlflow/mlflow →
CVE-2026-8147
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper…
8.1
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI…
9.1
Critical
CVE-2026-3198
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API…
6.5
Medium
CVE-2026-2651
A vulnerability in MLflow…
9.0
Critical