5.4
Moyenne
CVE-2025-1473 A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to…
Description
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacker to create a new account, which may be used to perform unauthorized actions on behalf of the malicious user.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| mlflow/mlflow 2.20 | premières → < 2.20.2 | 2.20.2 |
Références
- huntr.com huntr.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de mlflow/mlflow
Les 55 CVE de mlflow/mlflow →
CVE-2026-8147
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper…
8.1
Élevée
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI…
9.1
Critique
CVE-2026-3198
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API…
6.5
Moyenne
CVE-2026-2651
A vulnerability in MLflow…
9.0
Critique