WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor lfprojects✕Has a public PoC✕
Overview 21 matches · 0 in Waratek scope · 0 protected · 9 exploited · 1 CISA KEV · 5 EPSS ≥ 0.5
21matches 0in Waratek scope0.0% 0protected0.0% 9exploited42.9% 1CISA KEV4.8% 5EPSS ≥ 0.523.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 21 100.0% Withdrawn CVE 0 0.0%
Critical 8 38.1% High 12 57.1% Medium 1 4.8% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 21 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 9 42.9% Working exploit published 11 52.4% Proof of concept only 1 4.8% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / quarter
Not applicable: 21 Medium: 1High: 12Critical: 8 not blocked: 21 Proof of concept only: 1Working exploit published: 11Exploited: 9
Q1 231 Not applicable1 Critical1 not blocked1 Exploited1 Q2 232 Not applicable2 Critical1 High1 not blocked2 Exploited1 Working exploit published1 Q3 231 Not applicable1 Critical1 not blocked1 Working exploit published1 Q4 236 Not applicable6 Critical1 High4 Medium1 not blocked6 Exploited1 Working exploit published5 Q1 240 Q2 244 Not applicable4 High4 not blocked4 Exploited1 Working exploit published2 Proof of concept only1 Q3 240 Q4 240 Q1 251 Not applicable1 High1 not blocked1 Working exploit published1 Q2 250 Q3 250 Q4 252 Not applicable2 Critical2 not blocked2 Exploited2 Q1 260 Q2 263 Not applicable3 Critical1 High2 not blocked3 Exploited2 Working exploit published1 Q3 261 Not applicable1 Critical1 not blocked1 Exploited1
Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26Q3 26
21 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-64849 Critical 2026-08-17 Not applicable Exploited MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
CVE-2026-2652 High 2026-05-15 Not applicable Exploited A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled (`--app-name basic-auth`) and served via uvicorn (ASGI). The FastAPI permission middleware only enforces authentication on `/gateway/` routes, leaving other routes such as the Job API (`/ajax-api/3.0/jobs/*`) and the OpenTelemetry trace ingestion API (`/v1/traces`) unprotected. This allows unauthenticated remote attackers to submit jobs, read job results, cancel running jobs, and inject arbitrary trace data into experiments. The issue arises from an architectural mismatch between Flask and FastAPI authentication mechanisms, where the `_find_fastapi_validator()` function fails to handle non-`/gateway/` paths, resulting in a complete authentication bypass. This vulnerability is fixed in version 3.10.0.
CVE-2026-2614 High 2026-05-11 Not applicable Exploited A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.
CVE-2026-0545 Critical 2026-04-03 Not applicable Working exploit published In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.
CVE-2025-11201 Critical 2025-10-29 Not applicable Exploited MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
CVE-2025-49844 Critical 2025-10-03 Not applicable Exploited Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CVE-2024-8859 High 2025-03-20 Not applicable Working exploit published A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the file protocol results in an arbitrary file read vulnerability. This issue occurs because only the path part of the URL is checked, while parts such as query and parameters are not handled. The vulnerability is triggered if the user has configured the dbfs service, and during usage, the service is mounted to a local directory.
CVE-2024-2928 High 2024-06-06 Not applicable Working exploit published A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal sequences such as '../'. An attacker can exploit this flaw by manipulating the fragment part of the URI to read arbitrary files on the local file system, including sensitive files like '/etc/passwd'. The vulnerability is a bypass to a previous patch that only addressed similar manipulation within the URI's query string, highlighting the need for comprehensive validation of all parts of a URI to prevent LFI attacks.
CVE-2024-37054 High 2024-06-04 Not applicable Proof of concept only Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-3848 High 2024-05-16 Not applicable Exploited A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability arises from the application's handling of artifact URLs, where a '#' character can be used to insert a path into the fragment, effectively skipping validation. This allows an attacker to construct a URL that, when processed, ignores the protocol scheme and uses the provided path for filesystem access. As a result, an attacker can read arbitrary files, including sensitive information such as SSH and cloud keys, by exploiting the way the application converts the URL into a filesystem path. The issue stems from insufficient validation of the fragment portion of the URL, leading to arbitrary file read through path traversal.
CVE-2024-1483 High 2024-04-16 Not applicable Working exploit published A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By crafting a series of HTTP POST requests with specially crafted 'artifact_location' and 'source' parameters, using a local URI with '#' instead of '?', an attacker can traverse the server's directory structure. The issue occurs due to insufficient validation of user-supplied input in the server's handlers.
CVE-2023-6977 High 2023-12-20 Not applicable Working exploit published This vulnerability enables malicious users to read sensitive files on the server.
CVE-2023-6909 High 2023-12-18 Not applicable Exploited Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
CVE-2023-6831 High 2023-12-15 Not applicable Working exploit published Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2.
CVE-2023-6568 Medium 2023-12-07 Not applicable Working exploit published A reflected Cross-Site Scripting (XSS) vulnerability exists in the mlflow/mlflow repository, specifically within the handling of the Content-Type header in POST requests. An attacker can inject malicious JavaScript code into the Content-Type header, which is then improperly reflected back to the user without adequate sanitization or escaping, leading to arbitrary JavaScript execution in the context of the victim's browser. The vulnerability is present in the mlflow/server/auth/__init__.py file, where the user-supplied Content-Type header is directly injected into a Python formatted string and returned to the user, facilitating the XSS attack.
CVE-2023-43472 High 2023-12-05 Not applicable Working exploit published An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.
CVE-2023-6018 Critical 2023-11-16 Not applicable Working exploit published An attacker can overwrite any file on the server hosting MLflow without any authentication.
CVE-2023-3765 Critical 2023-07-19 Not applicable Working exploit published Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVE-2023-2780 Critical 2023-05-17 Not applicable Working exploit published Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
CVE-2023-2356 High 2023-04-28 Not applicable Exploited Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
CVE-2023-1177 Critical 2023-03-24 Not applicable Exploited Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.