CVE-2026-2611
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.
Risk Assessment
The risk is that an attacker can bypass the loopback-only restriction, modify the Assistant's configuration to enable full access, and then execute arbitrary commands via the Claude Code sub-agent, potentially leading to full system compromise.
Recommendation
Immediately upgrade MLflow to version 3.10.0 or later, which fixes this vulnerability. Until the update is applied, restrict access to the MLflow interface to trusted networks only.
Other vulnerabilities in MLflow
See all- CVE-2026-2393High
A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function accepts a user-controlled `url` parameter without validation, allowing an attacker to force the MLflow backend to send HTTP requests to internal services or arbitrary external servers.
- CVE-2026-64849CriticalActively exploited
MLflow versions 3.3.0 through 3.15.0 contain an SSRF vulnerability in the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint. URL validation is only performed on the original URL, while the webhook delivery mechanism follows redirects and re-resolves the hostname without pinning the validated address. Attackers can thereby reach internal or cloud metadata services and read response_status and response_body.
- CVE-2026-2651Critical
A vulnerability in MLflow versions up to 3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded.
- CVE-2026-0545Critical
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. Even with basic authentication enabled, any network client can submit, read, search, and cancel jobs without credentials.
- CVE-2025-15379Critical
A command injection vulnerability exists in MLflow version 3.8.0 in the model serving container initialization code. The `_install_model_dependencies_to_env()` function directly interpolates dependencies from the `python_env.yaml` file into a shell command without sanitization, allowing an attacker to execute arbitrary commands by supplying a malicious model artifact.
- CVE-2025-15036Critical
A path traversal vulnerability exists in the `extract_archive_to_dir` function of mlflow before version 3.7.0. Lack of tar member path validation allows an attacker to overwrite arbitrary files or escalate privileges.
- CVE-2025-15031Critical
A vulnerability in MLflow's pyfunc extraction process allows arbitrary file writes due to improper handling of tar archive entries. The use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory.
- CVE-2026-96804High
MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
- CVE-2026-96775High
MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.
- CVE-2026-79721High
Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.
Original NVD description (English source)
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine. By bypassing the loopback-only restriction, the attacker can modify the Assistant's configuration to enable full access, which in turn allows the execution of arbitrary commands via the Claude Code sub-agent. This issue is resolved in version 3.10.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS