CVE-2025-52967 gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation

Description

gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.

Affected products and versions

Product	Affected versions	Fixed in
MLflow 3.1	earliest → < 3.1.0	3.1.0

Other CVEs of MLflow

The 20 CVEs of MLflow →

CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf 7.0 High CVE-2024-2928 A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was… 7.5 High CVE-2024-3099 A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by… 5.4 Medium CVE-2024-37061 Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a… 8.8 High