# Mlflow vulnerabilities Source: https://junglewise.ai/threats/technologies/mlflow-mlflow Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 18:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mlflow-mlflow.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 33 vulnerabilities in Mlflow: 1 in the last 7 days and 15 in the last 90 days, 8 of them critical and 1 exploited in the wild. The most recent, CVE-2026-127202, was published on 12 November 2026. 9 vulnerabilities in the last four weeks, up 350% on the four before (2). 1 critical against 0. ## Counts - Last 7 days: 1 - Last 30 days: 10 - Last 90 days: 15 - All time: 33 (8 critical, 1 exploited in the wild) ## About Mlflow Open-source platform for managing machine learning experiments, models, and deployments. ## Latest Mlflow vulnerabilities - [CVE-2026-127202: MLflow path traversal in FileStore log outputs API](https://junglewise.ai/threats/cve-2026-127202-mlflow-before-3-18-0-using-the-filestore-backend-contains-a-path) (medium, CVSS 5.3, published 12 Nov 2026) - [CVE-2026-118628: MLflow get-artifacts server-side request forgery information disclosure](https://junglewise.ai/threats/cve-2026-118628-mlflow-get-artifacts-server-side-request-forgery-information) (high, CVSS 8.2, published 4 Nov 2026) - [CVE-2026-118627: MLflow SHAP load_explainer deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-118627-mlflow-shap-load-explainer-deserialization-of-untrusted-data) (high, CVSS 7.8, published 4 Nov 2026) - [CVE-2026-118625: MLflow Tracking Server missing authorization in get_endpoints](https://junglewise.ai/threats/cve-2026-118625-mlflow-tracking-server-missing-authorization-privilege) (medium, CVSS 6.3, published 4 Nov 2026) - [CVE-2026-118624: MLflow Tracking Server authorization bypass in Jobs API](https://junglewise.ai/threats/cve-2026-118624-mlflow-tracking-server-jobs-missing-authorization-information) (medium, CVSS 5.4, published 4 Nov 2026) - [CVE-2026-118623: MLflow PickleEvaluationArtifact deserialization of untrusted data](https://junglewise.ai/threats/cve-2026-118623-mlflow-pickleevaluationartifact-deserialization-of-untrusted) (high, CVSS 7.8, published 4 Nov 2026) - [CVE-2026-116692: MLflow arbitrary code execution in third-party scorer deserialization](https://junglewise.ai/threats/cve-2026-116692-mlflow-is-an-open-source-ai-engineering-platform-for-agents) (critical, CVSS 9.8, published 27 Oct 2026) - [CVE-2026-116691: MLflow credential leak in CrewAI autolog](https://junglewise.ai/threats/cve-2026-116691-mlflow-is-an-open-source-ai-engineering-platform-for-agents) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-116690: MLflow path traversal in prompt model version artifact access](https://junglewise.ai/threats/cve-2026-116690-mlflow-is-an-open-source-ai-engineering-platform-for-agents) (high, CVSS 7.5, published 27 Oct 2026) - [CVE-2026-115886: MLflow unsafe deserialization in scorer endpoints](https://junglewise.ai/threats/cve-2026-115886-mlflow-is-an-open-source-ai-engineering-platform-for-agents) (medium, CVSS 6.5, published 23 Oct 2026) - [CVE-2026-96804: MLflow statsmodels flavor arbitrary code execution via pickle deserialization](https://junglewise.ai/threats/cve-2026-96804-mlflow-s-statsmodel-flavor-versions-2-1-0-to-3-14-0-omits-the) (high, CVSS 8.8, published 23 Sep 2026) - [CVE-2026-96775: MLflow dspy flavor insufficient pickle deserialization control](https://junglewise.ai/threats/cve-2026-96775-mlflow-s-dspy-flavor-versions-2-0-applies-the-mlflow-allow-pickle) (high, CVSS 8.8, published 23 Sep 2026) - [CVE-2026-69148: MLflow CreateModelVersion authorization bypass via source validation](https://junglewise.ai/threats/cve-2026-69148-mlflow-createmodelversion-authorization-bypass-via-source) (high, CVSS 7.1, published 17 Aug 2026) - [CVE-2026-69146: MLflow LogInputs endpoint authorization bypass in basic-auth](https://junglewise.ai/threats/cve-2026-69146-mlflow-loginputs-endpoint-authorization-bypass-in-basic-auth) (medium, CVSS 6.5, published 17 Aug 2026) - [CVE-2026-64849: MLflow unauthenticated SSRF via unvalidated webhook redirects](https://junglewise.ai/threats/cve-2026-64849-mlflow-server-side-request-forgery) (critical, exploited in the wild, CVSS 9.3, published 17 Aug 2026) - [CVE-2026-71211: MLflow AI Gateway SSRF via unvalidated api_base](https://junglewise.ai/threats/cve-2026-71211-mlflow-ai-gateway-ssrf-via-unvalidated-api-base) (high, CVSS 7.1, published 5 Aug 2026) - [CVE-2026-8147: MLflow improper authorization in trace API endpoints](https://junglewise.ai/threats/cve-2026-8147-mlflow-improper-authorization-in-trace-api-endpoints) (high, CVSS 8.1, published 2 Jul 2026) - [CVE-2026-4035: MLflow AI Gateway credential exfiltration via environment variable resolution](https://junglewise.ai/threats/cve-2026-4035-mlflow-ai-gateway-credential-exfiltration-via-environment-variable) (critical, CVSS 9.1, published 3 Jun 2026) - [CVE-2026-3198: MLflow improper access control in Gateway API list endpoints](https://junglewise.ai/threats/cve-2026-3198-mlflow-improper-access-control-in-gateway-api-list-endpoints) (medium, CVSS 6.5, published 2 Jun 2026) - [CVE-2026-2651: MLflow missing authorization in multipart upload endpoints](https://junglewise.ai/threats/cve-2026-2651-mlflow-missing-authorization-in-multipart-upload-endpoints) (critical, CVSS 9, published 25 May 2026) - [CVE-2026-2734: MLflow improper access control in SearchModelVersions API](https://junglewise.ai/threats/cve-2026-2734-mlflow-improper-access-control-in-searchmodelversions-api) (medium, CVSS 6.5, published 21 May 2026) - [CVE-2026-2611: MLflow MLflow Assistant improper origin validation in /ajax-api](https://junglewise.ai/threats/cve-2026-2611-mlflow-mlflow-assistant-improper-origin-validation-in-ajax-api) (critical, CVSS 9.6, published 19 May 2026) - [CVE-2026-4137: MLflow arbitrary code execution via insecure temporary directory permissions](https://junglewise.ai/threats/cve-2026-4137-mlflow-arbitrary-code-execution-via-insecure-temporary-directory) (high, CVSS 7, published 18 May 2026) - [CVE-2026-2652: MLflow authentication bypass in FastAPI routes](https://junglewise.ai/threats/cve-2026-2652-mlflow-authentication-bypass-in-fastapi-routes) (high, CVSS 8.6, published 15 May 2026) - [CVE-2026-2614: MLflow arbitrary file read via prompt tag validation bypass](https://junglewise.ai/threats/cve-2026-2614-mlflow-arbitrary-file-read-via-prompt-tag-validation-bypass) (high, CVSS 7.5, published 11 May 2026) ## Most severe Mlflow vulnerabilities - [CVE-2026-64849: MLflow unauthenticated SSRF via unvalidated webhook redirects](https://junglewise.ai/threats/cve-2026-64849-mlflow-server-side-request-forgery) (critical, exploited in the wild, CVSS 9.3, published 17 Aug 2026) - [CVE-2025-15036: MLflow path traversal in extract_archive_to_dir](https://junglewise.ai/threats/cve-2025-15036-mlflow-path-traversal-in-extract-archive-to-dir) (critical, CVSS 10, published 30 Mar 2026) - [CVE-2026-0545: MLflow authentication bypass in FastAPI job endpoints](https://junglewise.ai/threats/cve-2026-0545-mlflow-authentication-bypass-in-fastapi-job-endpoints) (critical, CVSS 9.8, published 3 Apr 2026) - [CVE-2026-116692: MLflow arbitrary code execution in third-party scorer deserialization](https://junglewise.ai/threats/cve-2026-116692-mlflow-is-an-open-source-ai-engineering-platform-for-agents) (critical, CVSS 9.8, published 27 Oct 2026) - [CVE-2026-0596: MLflow command injection in model serving via model_uri](https://junglewise.ai/threats/cve-2026-0596-mlflow-command-injection-in-model-serving-via-model-uri) (critical, CVSS 9.6, published 31 Mar 2026) - [CVE-2026-2611: MLflow MLflow Assistant improper origin validation in /ajax-api](https://junglewise.ai/threats/cve-2026-2611-mlflow-mlflow-assistant-improper-origin-validation-in-ajax-api) (critical, CVSS 9.6, published 19 May 2026) - [CVE-2026-4035: MLflow AI Gateway credential exfiltration via environment variable resolution](https://junglewise.ai/threats/cve-2026-4035-mlflow-ai-gateway-credential-exfiltration-via-environment-variable) (critical, CVSS 9.1, published 3 Jun 2026) - [CVE-2026-2651: MLflow missing authorization in multipart upload endpoints](https://junglewise.ai/threats/cve-2026-2651-mlflow-missing-authorization-in-multipart-upload-endpoints) (critical, CVSS 9, published 25 May 2026) - [CVE-2025-14287: MLflow command injection in SageMaker container parameter](https://junglewise.ai/threats/cve-2025-14287-mlflow-command-injection-in-sagemaker-container-parameter) (high, CVSS 8.8, published 16 Mar 2026) - [CVE-2026-96804: MLflow statsmodels flavor arbitrary code execution via pickle deserialization](https://junglewise.ai/threats/cve-2026-96804-mlflow-s-statsmodel-flavor-versions-2-1-0-to-3-14-0-omits-the) (high, CVSS 8.8, published 23 Sep 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 350% on the four before (2). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 3 | 1 | 1 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 2 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 3 | 1 | 0 | | 2 Nov 2026 | 5 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Mlflow vulnerabilities", https://junglewise.ai/threats/technologies/mlflow-mlflow, 12 November 2026.