PT-2026-30820 · Databricks · Mlflow

Sławomir Zakrzewski · Published 2026-04-07 · Updated 2026-04-21 · CVE-2026-33865

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MLflow versions through 3.10.1

Description MLflow is susceptible to Stored Cross-Site Scripting (XSS) due to unsafe parsing of YAML-based MLmodel artifacts within its web interface. An authenticated attacker can upload a malicious MLmodel file that executes when another user views the artifact in the UI, potentially leading to session hijacking or unauthorized actions performed on behalf of the victim. Additionally, an authorization bypass exists in the AJAX endpoint used for downloading saved model artifacts. Missing access-control validation allows a user without appropriate permissions to directly query this endpoint and retrieve model artifacts they are not authorized to access.

Recommendations Update MLflow to a version later than 3.10.1.

Exploit

Fix

Missing Authorization

XSS

Weakness Enumeration

CWE-862

CWE-79

Related Identifiers

BIT-MLFLOW-2026-33865

BIT-MLFLOW-2026-33866

CVE-2026-33865

GHSA-46R5-X6JQ-V8G6

GHSA-FH64-R2VC-XVHR

PYSEC-2026-93

PYSEC-2026-94

Affected Products

Mlflow

References · 19

• 🔥 https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors · Exploit
• https://github.com/mlflow/mlflow/pull/21435 · Patch
• https://osv.dev/vulnerability/BIT-mlflow-2026-33865 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fh64-r2vc-xvhr · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-46r5-x6jq-v8g6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mlflow-2026-33866 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-93 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33865 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-94 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33866 · Security Note
• https://github.com/mlflow/mlflow · Note
• https://github.com/mlflow/mlflow/pull/21708 · Note
• https://github.com/mlflow/mlflow/commit/005b959cacda05d1423356cfcbd9ebeda8ff96a7 · Note
• https://github.com/mlflow/mlflow/commit/aca4dd0ec88a12f7655155c224371280e9b45dda · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-94.yaml · Note