CVE-2026-10803
LowCVSS 3.6Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
In MLflow up to version 3.10.0, a flaw in mlflow.data.digest_utils causes use of a weak hash function. The attack is local, high complexity, difficult to exploit, but an exploit has been published.
Risk Assessment
Risk of data manipulation or integrity bypass in systems using MLflow for dataset digest computation.
Recommendation
Update MLflow to a version above 3.10.0 when available. Monitor public exploits and consider temporarily disabling digest_utils.
Original NVD description (English source)
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.