PT-2026-1734 · Databricks · Mlflow

Published 2026-01-12 · Updated 2026-04-19 · CVE-2025-14279

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions MLFlow versions up to and including 3.4.0

Description MLFlow versions up to and including 3.4.0 are susceptible to DNS rebinding attacks because of missing Origin header validation within the MLFlow REST server. This allows malicious websites to circumvent Same-Origin Policy safeguards and perform unauthorized requests to REST endpoints. An attacker could query, update, and delete experiments through these endpoints, potentially resulting in data exfiltration, destruction, or manipulation. The REST server is affected.

Recommendations Update to version 3.5.0 or later.

Exploit

Fix

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

BIT-MLFLOW-2025-14279

CVE-2025-14279

GHSA-PGQP-8H46-6X4J

Affected Products

Mlflow

References · 13

• 🔥 https://huntr.com/bounties/ef478f72-2e4f-44dc-8055-fc06bef03108 · Exploit
• https://github.com/mlflow/mlflow/commit/b0ffd289e9b0d0cc32c9e3a9b9f3843ae83dbec3 · Patch
• https://osv.dev/vulnerability/CVE-2025-14279 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14279 · Security Note
• https://osv.dev/vulnerability/GHSA-pgqp-8h46-6x4j · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mlflow-2025-14279 · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://github.com/mlflow/mlflow/pull/17910 · Note
• https://twitter.com/CVEnew/status/2010645059490709855 · Twitter Post
• https://twitter.com/pulsepatchio/status/2045707497932005849 · Twitter Post
• https://twitter.com/hud_evals/status/2034418756550861059 · Twitter Post
• https://twitter.com/TheHackerWire/status/2010652935873847304 · Twitter Post
• https://t.me/CVEtracker/41979 · Telegram Post