CVE-2025-15379
CriticalCVSS 10.0Exploitation Probability (EPSS)
High risk83th percentile - higher than 83% of all known CVEs
Summary
A command injection vulnerability exists in MLflow version 3.8.0 in the model serving container initialization code. The `_install_model_dependencies_to_env()` function directly interpolates dependencies from the `python_env.yaml` file into a shell command without sanitization, allowing an attacker to execute arbitrary commands by supplying a malicious model artifact.
Risk Assessment
An attacker can remotely execute arbitrary commands on the system deploying the model, leading to full server compromise, data theft, or lateral movement within the infrastructure.
Recommendation
Immediately upgrade MLflow to version 3.8.2 or later. Always verify the contents of the `python_env.yaml` file before deploying models from external sources.
Other vulnerabilities in MLflow
See all- CVE-2026-2393High
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function accepts a user-controlled `url` parameter without validation, allowing an attacker to force the MLflow backend to send HTTP requests to internal services or arbitrary external servers.
- CVE-2026-64849CriticalActively exploited
MLflow versions 3.3.0 through 3.15.0 contain an SSRF vulnerability in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. URL validation is only performed on the original URL, while the webhook delivery mechanism follows redirects and re-resolves the hostname without pinning the validated address. Attackers can thereby reach internal or cloud metadata services and read response_status and response_body.
- CVE-2026-2651Critical
A vulnerability in MLflow versions up to 3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded.
- CVE-2026-2611Critical
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.
- CVE-2026-0545Critical
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. Even with basic authentication enabled, any network client can submit, read, search, and cancel jobs without credentials.
- CVE-2025-15036Critical
A path traversal vulnerability exists in the `extract_archive_to_dir` function of mlflow before version 3.7.0. Lack of tar member path validation allows an attacker to overwrite arbitrary files or escalate privileges.
- CVE-2025-15031Critical
A vulnerability in MLflow's pyfunc extraction process allows arbitrary file writes due to improper handling of tar archive entries. The use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory.
- CVE-2026-96804High
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
- CVE-2026-96775High
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
- CVE-2026-79721High
Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.
Original NVD description (English source)
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve arbitrary command execution on systems that deploy the model. The vulnerability affects versions 3.8.0 and is fixed in version 3.8.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS