Vulnerabilities in pkg:pypi/mlflow

Q: What is CVE-2026-2651?

CVE-2026-2651 is a security vulnerability in Mlflow involving MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled under CWE-1220: Insufficient Granularity of Access Control.

Q: Which Mlflow versions are affected?

Affected versions include releases prior to 3.10.0 across affected packages: mlflow.

Q: What version fixes CVE-2026-2651?

Upgrading to 3.10.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is mlflow affected?

Yes, mlflow is affected in releases prior to 3.10.0. Upgrade your dependency to 3.10.0 or later.

Q: What is the CVSS score of CVE-2026-2651?

CVE-2026-2651 has a CVSS v3.1 base score of 9.0 (CRITICAL) with vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2026-2651?

CVE-2026-2651 is classified under CWE-1220: Insufficient Granularity of Access Control (The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.).

Q: How can I check PyPI dependencies for CVE-2026-2651?

Run the dependency tree command: 'pip show mlflow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-8c7q-86fq-vvmh

Advisory Summary

CVE-2026-2651 is a CRITICAL (CVSS 9.0) mlflow allows unauthorized access to vulnerability (CWE-1220: Insufficient Granularity of Access Control) affecting Mlflow libraries in the PyPI ecosystem. The issue involves mlflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled. Remediation is available by upgrading affected packages to version 3.10.0.

82 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:pypi/mlflow

82 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:pypi/mlflow. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-8c7q-86fq-vvmh	CVE-2026-2651	CRITICAL	MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled
GHSA-67c5-x5mf-rppq	CVE-2026-2611	CRITICAL	MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution
GHSA-7gwp-5pfp-969j	CVE-2026-64849	CRITICAL	MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
GHSA-gqvg-gmmx-x4hm	-	HIGH	MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
GHSA-f2m9-wcf4-cwwx	CVE-2026-4137	HIGH	MLFlow Creates a Temporary File With Insecure Permissions
GHSA-h7x2-h6g9-p789	CVE-2026-71211	HIGH	MLflow AI Gateway permits SSRF through an unvalidated api_base
GHSA-2cm6-r77w-6g96	CVE-2026-8147	HIGH	MLflow: trace API endpoints lack proper authorization validators
GHSA-5qmp-p3c4-72qj	CVE-2026-10803	LOW	MLflow: Deterministic sampling in dataset digest enables predictable collisions
GHSA-g35p-px32-whv6	CVE-2026-4035	CRITICAL	MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration
GHSA-r5m9-wm49-959f	CVE-2026-3198	MODERATE	MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions
GHSA-w5xq-c4pf-ghq7	CVE-2026-2734	MODERATE	MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
GHSA-fh64-r2vc-xvhr	CVE-2026-33865	MODERATE	MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface
GHSA-46r5-x6jq-v8g6	CVE-2026-33866	MODERATE	MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint
GHSA-75cm-x2w3-8mgf	CVE-2026-2652	HIGH	MLflow: unauthenticated access to certain FastAPI routes
GHSA-rvhj-8chj-8v3c	CVE-2026-0596	CRITICAL	Mlflow: Command Injection when serving models with enable_mlserver=True
GHSA-42h5-h8qh-vv9v	CVE-2026-2614	HIGH	MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
GHSA-65h7-c7c4-mghx	CVE-2026-2393	HIGH	MLflow Has a Server-Side Request Forgery (SSRF) Vulnerability
GHSA-7qhf-v65m-g5f3	CVE-2026-0545	CRITICAL	mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization
GHSA-r23q-823p-vmf7	CVE-2025-15379	CRITICAL	MLflow Command Injection vulnerability
GHSA-vhcx-3pq2-4fvc	CVE-2025-15036	CRITICAL	MLFlow path traversal vulnerability
GHSA-g6pg-52vf-843h	CVE-2025-15381	HIGH	MLFlow allows Tracing + Assessments Access
GHSA-fhff-qmm8-h2fp	CVE-2025-15031	HIGH	Arbitrary file write via tar traversal in mlflow
GHSA-q2r8-vmq7-fpx2	CVE-2026-2033	HIGH	MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
GHSA-gq3w-7jj3-x7gr	CVE-2026-2635	CRITICAL	MLflow Use of Default Password Authentication Bypass Vulnerability
GHSA-xch3-2f9x-wh9f	CVE-2025-14287	HIGH	MLflow has a command injection in mlflow/sagemaker/__init__.py
GHSA-4x5p-f36r-mxxr	CVE-2025-10279	HIGH	mlflow Creates of Temporary File in Directory with Insecure Permissions
GHSA-pgqp-8h46-6x4j	CVE-2025-14279	HIGH	MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
GHSA-5cvj-7rg6-jggj	CVE-2025-11201	HIGH	MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
GHSA-6xj8-rrqx-r4cv	CVE-2025-11200	HIGH	MLflow Weak Password Requirements Authentication Bypass Vulnerability
GHSA-wf7f-8fxf-xfxc	CVE-2024-37059	HIGH	MLFlow unsafe deserialization
GHSA-wxj7-3fx5-pp9m	CVE-2025-52967	MODERATE	MLFlow SSRF via gateway_proxy_handler
GHSA-969w-gqqr-g6j3	CVE-2025-1473	MODERATE	MLflow Cross-Site Request Forgery (CSRF) vulnerability
GHSA-fmxj-6h9g-6vw3	CVE-2023-3765	CRITICAL	MLflow Path Traversal vulnerability
GHSA-4rj2-9gcx-5qhx	CVE-2025-1474	LOW	MLflow has Weak Password Requirements
GHSA-v945-r3rc-6fjm	CVE-2023-6753	HIGH	Path traversal in MLflow
GHSA-j46q-5pxx-8vmw	CVE-2024-2928	HIGH	Local File Inclusion in mlflow
GHSA-5q6c-ffvg-xcm9	CVE-2024-0520	CRITICAL	Remote code execution in mlflow
GHSA-rfqq-wq6w-72jm	CVE-2024-3848	HIGH	MLflow has a Local File Read/Path Traversal bypass
GHSA-hq88-wg7q-gp4g	CVE-2024-3573	CRITICAL	mlflow vulnerable to Path Traversal
GHSA-3v79-q7ph-j75h	CVE-2024-27133	CRITICAL	MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution
GHSA-6749-m5cp-6cg7	CVE-2024-27132	CRITICAL	Cross-site Scripting in MLFlow
GHSA-q3gw-8236-5jw4	CVE-2024-6838	MODERATE	MLflow Uncontrolled Resource Consumption vulnerability
GHSA-49m6-vrr9-2cqm	CVE-2025-0453	MODERATE	MLflow Uncontrolled Resource Consumption vulnerability
GHSA-4rqf-8pfm-p36r	CVE-2024-8859	HIGH	MLflow has a Local File Read/Path Traversal in dbfs
GHSA-qpgc-w4mg-6v92	CVE-2024-27134	HIGH	MLflow's excessive directory permissions allow local privilege escalation
GHSA-cxfr-5q3r-2rc2	CVE-2023-6709	HIGH	Jinja2 template injection in mlflow
GHSA-ffw3-6378-cqgp	CVE-2023-4033	HIGH	mlflow vulnerable to OS Command Injection
GHSA-8f8q-q2j7-7j2m	CVE-2024-3099	MODERATE	Undefined Behavior in mlflow
GHSA-xg73-94fp-g449	CVE-2023-1177	CRITICAL	mlflow is vulnerable to remote file access in `mlflow server` and `mlflow ui` CLIs
GHSA-vqj2-4v8m-8vrq	CVE-2022-0736	HIGH	Insecure Temporary File in mlflow
GHSA-wp72-7hj9-5265	CVE-2023-1176	MODERATE	Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs
GHSA-x422-6qhv-p29g	CVE-2023-2356	HIGH	Relative path traversal in mlflow
GHSA-5r3q-93q3-f978	CVE-2023-6909	HIGH	MLflow Path Traversal Vulnerability
GHSA-wjq3-7jxx-whj9	CVE-2023-2780	CRITICAL	mlflow Path Traversal vulnerability
GHSA-j62r-wxqq-f3gf	CVE-2024-1558	HIGH	mlflow vulnerable to Path Traversal
GHSA-f82r-jj5r-6g97	CVE-2024-1483	HIGH	mlflow Path Traversal vulnerability
GHSA-5p3h-7fwh-92rc	CVE-2023-6018	CRITICAL	Remote Code Execution due to Full Controled File Write in mlflow
GHSA-j8mg-pqc5-x9gj	CVE-2024-37057	HIGH	MLFlow unsafe deserialization
GHSA-x38x-g6gr-jqff	CVE-2024-37055	HIGH	MLFlow unsafe deserialization
GHSA-cwgg-w6mp-w9hg	CVE-2024-37058	HIGH	MLFlow unsafe deserialization
GHSA-7p8j-qv6x-f4g4	CVE-2024-37056	HIGH	MLFlow unsafe deserialization
GHSA-43c4-9qgj-x742	CVE-2024-37053	HIGH	MLFlow unsafe deserialization
GHSA-76cg-cfhx-373f	CVE-2024-37052	HIGH	MLFlow unsafe deserialization
GHSA-cv6c-7963-wxcg	CVE-2024-37060	HIGH	MLFlow unsafe deserialization
GHSA-ghv6-9r9j-wh4j	CVE-2024-37054	HIGH	MLFlow unsafe deserialization
GHSA-pqcv-qw2r-r859	CVE-2024-37061	HIGH	MLFlow improper input validation
GHSA-p4jx-q62p-x5jr	CVE-2024-4263	MODERATE	MLflow allows low privilege users to delete any artifact
GHSA-vwhf-3v6x-wff8	CVE-2023-6568	MODERATE	Cross-site Scripting (XSS) in MLflow
GHSA-m49c-5c52-6696	CVE-2024-1594	HIGH	mlflow vulnerable to Path Traversal
GHSA-f42m-mvfv-cgw5	CVE-2024-1593	HIGH	mlflow vulnerable to Path Traversal
GHSA-5mvj-wmgj-7q8c	CVE-2024-1560	HIGH	mlflow vulnerable to Path Traversal
GHSA-4qq5-mxxx-m6gg	CVE-2023-6014	CRITICAL	MLflow authentication requirement bypass can allow a user to arbitrarily create an account
GHSA-554w-xh4j-8w64	CVE-2023-6831	CRITICAL	Path traversal in MLflow
GHSA-hh8p-p8mp-gqhm	CVE-2023-6975	CRITICAL	MLFlow Path Traversal Vulnerability
GHSA-qg8p-32gr-gh6x	CVE-2023-6977	HIGH	MLflow Local File Disclosure Vulnerability
GHSA-hvc6-42vf-jhf8	CVE-2023-6940	HIGH	mlflow Command Injection vulnerability
GHSA-59v3-898r-qwhj	CVE-2023-6974	CRITICAL	MLflow Server-Side Request Forgery (SSRF)
GHSA-wv8q-4f85-2p8p	CVE-2023-6976	HIGH	MLflow Path Traversal Vulnerability
GHSA-wqxf-447m-6f5f	CVE-2023-43472	HIGH	Information exposure in MLflow
GHSA-f798-qm4r-23r5	CVE-2023-6015	CRITICAL	MLflow allowed arbitrary files to be PUT onto the server
GHSA-wc6j-5g83-xfm6	CVE-2023-30172	HIGH	mflow vulnerable to directory traversal
GHSA-83fm-w79m-64r5	-	CRITICAL	Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs

CVE-2026-2651 at a Glance

CVE Identifier CVE-2026-2651

GHSA Identifier GHSA-8c7q-86fq-vvmh

Severity CRITICAL

CVSS v3.1 Base Score 9.0

CWE Classification CWE-1220: Insufficient Granularity of Access Control

Affected Product Mlflow

Package Ecosystem PyPI

Published Date 2026-05-26

Last Updated 2026-10-06

Security Impact

CVSS: 9.0

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction Required (UI:R)

Scope Changed (S:C)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2026-2651

To remediate this vulnerability, upgrade all affected Mlflow dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

mlflow fixed: 3.10.0

pip install mlflow>=3.10.0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show mlflow

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2026-2651, inspect your installed packages using pip:

pip show mlflow

Analyze the terminal output to locate any version of Mlflow in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 3.10.0), your application is affected.

Note: The pip show mlflow command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-1220: Insufficient Granularity of Access Control, where the product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. however, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets. In Mlflow, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.

CVE-2026-2651 Affected Mlflow Versions

1 component(s)

Fixed Versions:

3.10.0

Product / Package	Ecosystem	Affected Versions	Fixed Version
mlflow pypi/mlflow	PyPI	< 3.10.0	3.10.0

References

NVD — CVE-2026-2651 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-2651

Security Fix Commit FIX COMMIT

https://github.com/mlflow/mlflow/commit/d7290811d8f3c95366d80109424edc1fb1ad966f

Mlflow Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2026-2651

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2481117

GitHub Advisory / Wiki ADVISORY

https://github.com/advisories/GHSA-8c7q-86fq-vvmh

Mlflow Source Repository REPOSITORY

https://github.com/mlflow/mlflow

Mlflow Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-2220.yaml

huntr.com/bounties/65beb119-d... WEB

https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dc

Mlflow Security Information SECURITY

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2651.json

Frequently Asked Questions

What is CVE-2026-2651?

CVE-2026-2651 is a security vulnerability in Mlflow involving MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled under CWE-1220: Insufficient Granularity of Access Control.

Which Mlflow versions are affected?

Affected versions include releases prior to 3.10.0 across affected packages: mlflow.

What version fixes CVE-2026-2651?

Upgrading to 3.10.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is mlflow affected?

Yes, mlflow is affected in releases prior to 3.10.0. Upgrade your dependency to 3.10.0 or later.

What is the CVSS score of CVE-2026-2651?

CVE-2026-2651 has a CVSS v3.1 base score of 9.0 (CRITICAL) with vector string CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

What CWE is associated with CVE-2026-2651?

CVE-2026-2651 is classified under CWE-1220: Insufficient Granularity of Access Control (The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.).

How can I check PyPI dependencies for CVE-2026-2651?

Run the dependency tree command: 'pip show mlflow'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8c7q-86fq-vvmh",
  "modified" : "2026-10-06T18:43:55Z",
  "published" : "2026-05-26T13:30:39Z",
  "aliases" : [ "CVE-2026-2651" ],
  "summary" : "MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled",
  "details" : "A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "mlflow"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.10.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-2651"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/mlflow/mlflow/commit/d7290811d8f3c95366d80109424edc1fb1ad966f"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2026-2651"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2481117"
  }, {
    "type" : "ADVISORY",
    "url" : "https://github.com/advisories/GHSA-8c7q-86fq-vvmh"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/mlflow/mlflow"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-2220.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://huntr.com/bounties/65beb119-d3e0-4e03-af2f-fa98f78f83dc"
  }, {
    "type" : "WEB",
    "url" : "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2651.json"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-1220", "CWE-862" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-30T16:48:21Z",
    "nvd_published_at" : "2026-05-25T07:16:15Z"
  }
}

CVSS V3

9.0 CRITICAL