MLflow vulnerabilities

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function accepts a user-controlled `url` parameter without validation, allowing an attacker to force the MLflow backend to send HTTP requests to internal services or arbitrary external servers.

In MLflow from 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of allowed modules rather than requiring an exact allowed module. An attacker can place a Python module under a writable allowed package and invoke it via /ajax-api/3.0/mlflow/scorer/invoke, leading to code execution. Version 3.17.0 fixes the issue.

A vulnerability in MLflow versions up to 3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when `--serve-artifacts` mode is enabled. The authorization logic does not enforce resource-level permission checks for `/mlflow-artifacts/mpu/*` endpoints, enabling attackers to overwrite artifacts belonging to other users. This can lead to unauthorized cross-user writes, model supply chain poisoning, and arbitrary code execution when compromised models are loaded.

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. Even with basic authentication enabled, any network client can submit, read, search, and cancel jobs without credentials.

A command injection vulnerability exists in MLflow version 3.8.0 in the model serving container initialization code. The `_install_model_dependencies_to_env()` function directly interpolates dependencies from the `python_env.yaml` file into a shell command without sanitization, allowing an attacker to execute arbitrary commands by supplying a malicious model artifact.

A path traversal vulnerability exists in the `extract_archive_to_dir` function of mlflow before version 3.7.0. Lack of tar member path validation allows an attacker to overwrite arbitrary files or escalate privileges.

A vulnerability in MLflow's pyfunc extraction process allows arbitrary file writes due to improper handling of tar archive entries. The use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory.

MLflow contains a weak password requirements vulnerability that allows authentication bypass. Authentication is not required to exploit it; the flaw results from weak password requirements and can be leveraged to bypass authentication on the system.

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.

MLflow from 3.12.0rc0 until 3.17.0 in the scorer invoke, register, and GenAI evaluate endpoints (including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke) accepts serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or constructor arguments; with trulens and trulens-providers-litellm installed, an attacker can force an outbound request to a chosen host with controlled headers and body.

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend. An unauthenticated attacker can submit a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint, causing trace_info.yaml, request_metadata and tag files to be written outside the intended experiment trace directory (within the server process's filesystem permissions). FileStore was the default backend before MLflow 3.7.0 and is opt-in thereafter.

MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load_model(), which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

MLflow's dspy flavor, versions >= 2.0, applies the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control only when the model_path ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact.

Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to execute arbitrary code on an end user's system when loaded by the project.

MLflow prior to 3.15.0 allows authenticated users to create a model version referencing another user's artifact directory and read files without the required READ permission.

MLflow is an open source AI engineering platform. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0.

MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body.

In MLflow versions prior to 3.14.0, when authentication is enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation.

In MLflow up to version 4666cffc7912ea606d592fc38d6a75e2935f65e7, a missing authorization vulnerability was found in the Experiment-scoped Label Schema CRUD API. This flaw allows remote manipulation of data without proper authentication, though exploitation is difficult due to high attack complexity.

In MLflow up to version 3.10.0, a flaw in mlflow.data.digest_utils causes use of a weak hash function. The attack is local, high complexity, difficult to exploit, but an exploit has been published.

Vulnerability in mlflow/mlflow prior to 3.11.0 allows environment variable resolution in AI Gateway secrets, leading to exfiltration of sensitive server-side credentials.

MLflow 3.9.0 with basic-auth enabled fails to enforce authorization for Gateway API endpoints: ListGatewaySecretInfos, ListGatewayEndpoints, and ListGatewayModelDefinitions. Any authenticated user, regardless of permissions, can enumerate all gateway secrets, endpoint configurations, and model definitions.

In mlflow/mlflow up to version 3.9.0, the SearchModelVersions REST API and GraphQL endpoints lack proper authorization checks, allowing any authenticated user to enumerate all model versions. Fixed in version 3.10.0.

In mlflow/mlflow prior to version 3.11.0, functions creating temporary directories set insecure permissions (0o777 and 0o770). This allows a local attacker to tamper with model artifacts, leading to arbitrary code execution upon deserialization via cloudpickle.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue occurs when a CreateModelVersion request includes the tag mlflow.prompt.is_prompt, which bypasses source path validation. The get_model_version_artifact_handler() function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise.

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization, allowing an attacker to execute arbitrary commands.

In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the experiment, to read trace information and create assessments for traces they should not have access to. This vulnerability impacts confidentiality by exposing trace metadata and integrity by allowing unauthorized creation of assessments.

A command injection vulnerability exists in mlflow/mlflow before version 3.7.0 in the `mlflow/sagemaker/__init__.py` file. Attackers can supply malicious container image names via the `--container` parameter, which are directly interpolated into shell commands executed by `os.system()`, allowing arbitrary command execution.

A vulnerability in MLflow allows remote attackers to bypass authentication due to hard-coded default credentials in the basic_auth.ini file. No authentication is required to exploit this flaw, which can lead to arbitrary code execution in the context of the administrator.

A directory traversal vulnerability in MLflow Tracking Server allows remote code execution via improper validation of artifact file paths. The flaw enables unauthenticated attackers to execute arbitrary code in the context of the service account.