MLflow vulnerabilities
90 published CVEs name MLflow among the affected products; CISA lists 1 of them as exploited in the wild.
- 90Published CVEs90 of them scored
- 42Last 12 monthspublished in the last year
- 24Critical47 more rated high
- 1Known exploitedin CISA's KEV catalog
Known exploited
Newest addition to KEV first.
- CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
mlflow · mlflow
ExploitedCritical9.3