GHSA-pgqp-8h46-6x4j BIT-mlflow-2025-14279 CVE-2025-14279 PYSEC-2026-1656
MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
- Severity
- 8.1 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.22%
- Chance of exploitation in the next 30 days. Higher than 12.27% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-346 Origin Validation Error
- Fix
3.5.0- Upgrade mlflow to this version or later
Description
MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| mlflow | < 3.5.0 |
3.5.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mlflow PyPI → 3.5.0
- pip
pip install --upgrade "mlflow>=3.5.0"- poetry
poetry add "mlflow>=3.5.0"- uv
uv add "mlflow>=3.5.0"
Severity breakdown
CVSS 3.0 8.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-346: Origin Validation Error
The product does not properly verify that the source of data or communication is valid.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7gwp-5pfp-969j MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | Critical Known exploited | Also affects mlflow |
| GHSA-26p8-2jq9-3vq9 MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules | Critical | Also affects mlflow |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Also affects mlflow |
| GHSA-m65p-9j7q-6w33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source | High | Also affects mlflow |
| GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Medium | Also affects mlflow |
| GHSA-wqmh-qccw-pqwf MLflow FileStore trace IDs allow path traversal and arbitrary file writes | High | Also affects mlflow |
| GHSA-gqvg-gmmx-x4hm MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact | High | Also affects mlflow |
| GHSA-h7x2-h6g9-p789 MLflow AI Gateway permits SSRF through an unvalidated api_base | High | Also affects mlflow |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor