PT-2026-46189 · Mlflow · Mlflow

Dem0 · CVE-2026-10803 · Published 2026-06-04 · Updated 2026-06-05

Positive Technologies (AI Summary)

CVSS v3.1

3.6

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.10.1

Description A flaw in the Dataset Digest Computation component allows for the use of a weak hash. This issue specifically affects the mlflow.data.digest utils() function within the mlflow/data/digest utils.py file. An attack can be launched on the local host, although it is characterized by high complexity and difficult exploitability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

CWE-328

Related Identifiers

BIT-MLFLOW-2026-10803

CVE-2026-10803

GHSA-5QMP-P3C4-72QJ

PYSEC-2026-195

Affected Products

Mlflow

References · 16

• 🔥 https://github.com/mlflow/mlflow/issues/22419 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10803.json · Exploit
• https://github.com/mlflow/mlflow/pull/22420 · Patch
• https://osv.dev/vulnerability/CVE-2026-10803 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-10803 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-195 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mlflow-2026-10803 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5qmp-p3c4-72qj · Vendor Advisory
• https://github.com/mlflow/mlflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-195.yaml · Note
• https://twitter.com/VulmonFeeds/status/2062535663740768592 · Twitter Post
• https://t.me/cveNotify/165969 · Telegram Post
• https://vuldb.com/cve/CVE-2026-10803 · Note
• https://vuldb.com/submit/831462 · Note
• https://vuldb.com/vuln/368252 · Note