WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor lfprojects✕
Overview 21 matches · 0 in Waratek scope · 0 protected · 4 exploited · 1 CISA KEV · 8 public PoC · 4 EPSS ≥ 0.5
21matches 0in Waratek scope0.0% 0protected0.0% 4exploited19.0% 1CISA KEV4.8% 8public PoC38.1% 4EPSS ≥ 0.519.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 21 100.0% Withdrawn CVE 0 0.0%
Critical 21 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 21 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 19.0% Working exploit published 4 19.0% Proof of concept only 10 47.6% Forecast only 0 0.0% No public exploit 3 14.3%
split by peak 4 / quarter
Not applicable: 21 Critical: 21 not blocked: 21 No public exploit: 3Proof of concept only: 10Working exploit published: 4Exploited: 4
Q1 232 Not applicable2 Critical2 not blocked2 Exploited1 Proof of concept only1 Q2 231 Not applicable1 Critical1 not blocked1 Working exploit published1 Q3 231 Not applicable1 Critical1 not blocked1 Working exploit published1 Q4 234 Not applicable4 Critical4 not blocked4 Working exploit published1 Proof of concept only1 No public exploit2 Q1 242 Not applicable2 Critical2 not blocked2 Proof of concept only2 Q2 241 Not applicable1 Critical1 not blocked1 Proof of concept only1 Q3 240 Q4 240 Q1 250 Q2 250 Q3 250 Q4 253 Not applicable3 Critical3 not blocked3 Exploited2 No public exploit1 Q1 263 Not applicable3 Critical3 not blocked3 Proof of concept only3 Q2 263 Not applicable3 Critical3 not blocked3 Working exploit published1 Proof of concept only2 Q3 261 Not applicable1 Critical1 not blocked1 Exploited1
Q1 23Q3 23Q1 24Q3 24Q1 25Q3 25Q1 26Q3 26
21 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-64849 Critical 2026-08-17 Not applicable Exploited MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.
CVE-2026-2651 Critical 2026-05-25 Not applicable Proof of concept only A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded. The issue is resolved in version 3.10.0.
CVE-2026-2611 Critical 2026-05-19 Not applicable Proof of concept only In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
CVE-2026-0545 Critical 2026-04-03 Not applicable Working exploit published In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the latest version of the repository. If job execution is enabled (`MLFLOW_SERVER_ENABLE_JOB_EXECUTION=true`) and any job function is allowlisted, any network client can submit, read, search, and cancel jobs without credentials, bypassing basic-auth entirely. This can lead to unauthenticated remote code execution if allowed jobs perform privileged actions such as shell execution or filesystem changes. Even if jobs are deemed safe, this still constitutes an authentication bypass, potentially resulting in job spam, denial of service (DoS), or data exposure in job results.
CVE-2025-15379 Critical 2026-03-30 Not applicable Proof of concept only A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
CVE-2025-15036 Critical 2026-03-30 Not applicable Proof of concept only A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present in versions before v3.7.0, arises due to the lack of validation of tar member paths during extraction. An attacker with control over the tar.gz file can exploit this issue to overwrite arbitrary files or gain elevated privileges, potentially escaping the sandbox directory in multi-tenant or shared cluster environments.
CVE-2025-15031 Critical 2026-03-18 Not applicable Proof of concept only A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, as it can lead to arbitrary file overwrites and potential remote code execution.
CVE-2025-11201 Critical 2025-10-29 Not applicable Exploited MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
CVE-2025-11200 Critical 2025-10-29 Not applicable No public exploit MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
CVE-2025-49844 Critical 2025-10-03 Not applicable Exploited Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potentially lead to remote code execution. The problem exists in all versions of Redis with Lua scripting. This issue is fixed in version 8.2.2. To workaround this issue without patching the redis-server executable is to prevent users from executing Lua scripts. This can be done using ACL to restrict EVAL and EVALSHA commands.
CVE-2024-3573 Critical 2024-04-16 Not applicable Proof of concept only mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the system. The issue arises from the 'is_local_uri' function's failure to properly handle URIs with empty or 'file' schemes, leading to the misclassification of URIs as non-local. Attackers can exploit this by crafting malicious model versions with specially crafted 'source' parameters, enabling the reading of sensitive files within at least two directory levels from the server's root.
CVE-2024-27133 Critical 2024-02-23 Not applicable Proof of concept only Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE when running the recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over dataset table fields.
CVE-2024-27132 Critical 2024-02-23 Not applicable Proof of concept only Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an untrusted recipe in Jupyter Notebook. The vulnerability stems from lack of sanitization over template variables.
CVE-2023-6975 Critical 2023-12-20 Not applicable No public exploit A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
CVE-2023-6974 Critical 2023-12-20 Not applicable No public exploit A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.
CVE-2023-6018 Critical 2023-11-16 Not applicable Working exploit published An attacker can overwrite any file on the server hosting MLflow without any authentication.
CVE-2023-6014 Critical 2023-11-16 Not applicable Proof of concept only An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.
CVE-2023-3765 Critical 2023-07-19 Not applicable Working exploit published Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
CVE-2023-2780 Critical 2023-05-17 Not applicable Working exploit published Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1.
CVE-2023-1177 Critical 2023-03-24 Not applicable Exploited Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
CVE-2023-23619 Critical 2023-01-26 Not applicable Proof of concept only Modelina is a library for generating data models based on inputs such as AsyncAPI, OpenAPI, or JSON Schema documents. Versions prior to 1.0.0 are vulnerable to Code injection. This issue affects anyone who is using the default presets and/or does not handle the functionality themself. This issue has been partially mitigated in version 1.0.0, with the maintainer's GitHub Security Advisory (GHSA) noting "It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue. Further similar situations are NOT seen as a security issue, but intended behavior." The suggested workaround from the maintainers is "Fully custom presets that change the entire rendering process which can then escape the user input."