mlflow/mlflow vulnerabilities

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled. Issues with the authentication mechanisms lead to a bypass of protections on routes such as the Job API and the OpenTelemetry trace ingestion API.

There is an absolute path traversal vulnerability in the GitHub repository mlflow/mlflow prior to version 2.5.0.

There is an OS Command Injection vulnerability in the GitHub repository mlflow/mlflow prior to version 2.6.0.