CVE-2025-52967 gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation

Description

gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
MLflow 3.1	premières → < 3.1.0	3.1.0

Autres CVE de MLflow

Les 20 CVE de MLflow →

CVE-2024-27134 Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf 7.0 Élevée CVE-2024-2928 A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was… 7.5 Élevée CVE-2024-3099 A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by… 5.4 Moyenne CVE-2024-37061 Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a… 8.8 Élevée