CVE-2025-11200
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk73th percentile - higher than 73% of all known CVEs
Summary
MLflow contains a weak password requirements vulnerability that allows authentication bypass. Authentication is not required to exploit it; the flaw results from weak password requirements and can be leveraged to bypass authentication on the system.
Risk Assessment
A remote attacker can bypass authentication and gain access to the MLflow system without valid credentials. This may lead to unauthorized access to platform data and functionality.
Recommendation
Update MLflow to a version containing the fix and enforce strong password policies. Restrict network access to the MLflow interface.
Other vulnerabilities in MLflow
See all- CVE-2026-2393High
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function accepts a user-controlled `url` parameter without validation, allowing an attacker to force the MLflow backend to send HTTP requests to internal services or arbitrary external servers.
- CVE-2026-64849CriticalActively exploited
MLflow versions 3.3.0 through 3.15.0 contain an SSRF vulnerability in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. URL validation is only performed on the original URL, while the webhook delivery mechanism follows redirects and re-resolves the hostname without pinning the validated address. Attackers can thereby reach internal or cloud metadata services and read response_status and response_body.
- CVE-2026-2651Critical
A vulnerability in MLflow versions up to 3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded.
- CVE-2026-2611Critical
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.
- CVE-2026-0545Critical
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. Even with basic authentication enabled, any network client can submit, read, search, and cancel jobs without credentials.
- CVE-2025-15379Critical
A command injection vulnerability exists in MLflow version 3.8.0 in the model serving container initialization code. The `_install_model_dependencies_to_env()` function directly interpolates dependencies from the `python_env.yaml` file into a shell command without sanitization, allowing an attacker to execute arbitrary commands by supplying a malicious model artifact.
- CVE-2025-15036Critical
A path traversal vulnerability exists in the `extract_archive_to_dir` function of mlflow before version 3.7.0. Lack of tar member path validation allows an attacker to overwrite arbitrary files or escalate privileges.
- CVE-2025-15031Critical
A vulnerability in MLflow's pyfunc extraction process allows arbitrary file writes due to improper handling of tar archive entries. The use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory.
- CVE-2026-96804High
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
- CVE-2026-96775High
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
Original NVD description (English source)
MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from weak password requirements. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-26916.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS