#MLflow
All CosmicBytez Labs articles tagged #MLflow, across news, security advisories, how-to guides, and projects.
- News
CISA Warns of Hackers Exploiting Critical MLflow Vulnerability
CVE-2026-64849 (CVSS 9.3): Active SSRF exploitation in MLflow lets attackers steal AWS cloud credentials via redirect bypass. Added to CISA KEV.
- Security
CVE-2026-64849: MLflow SSRF Webhook Bypass Actively Exploited
Critical unauthenticated SSRF in MLflow's webhook system lets attackers redirect requests to steal AWS credentials. Upgrade to 3.15.0.
- Security
CVE-2026-4035: MLflow AI Gateway Credential Exfiltration via Env Variable Resolution
A CVSS 9.1 critical flaw in MLflow AI Gateway allows server-side environment variables in api_key fields to be resolved and exfiltrated to attacker-controlled…
- Security
CVE-2026-2611: MLflow 3.9.0 Improper Origin Validation
A critical CVSS 9.6 vulnerability in MLflow 3.9.0 allows a remote attacker to exploit improper origin validation in the MLflow Assistant's /ajax-api...
- Security
CVE-2026-0596: MLflow Command Injection via Unsanitized
A critical command injection vulnerability in mlflow/mlflow allows attackers to execute arbitrary shell commands by embedding metacharacters in the...
- Security
CVE-2025-15036: MLflow Path Traversal in Archive Extraction
A critical path traversal vulnerability in MLflow's extract_archive_to_dir function allows attackers to write arbitrary files outside the intended...
- Security
CVE-2025-15379: MLflow Command Injection in Model Serving
A maximum-severity command injection vulnerability in MLflow's model serving container initialization allows attackers to execute arbitrary OS commands...