search
MLflow Tracking Server
Trends
- 1New MLflow vulnerability allows information disclosure, scored 5.4โ๐จ EUVD-2026-116620 ๐ Score: 5.4/10 (CVSS v3.1) ๐ฆ Product: MLflow ๐ข Vendor: mlflow ๐ Updated: 2026-11-04 ๐ MLflow Trackin
A medium-severity vulnerability, EUVD-2026-116620, has been catalogued in MLflow, the open-source machine learning platform. The flaw, rated 5.4 out of 10 under CVSS v3.1, lies in the MLflow Tracking Server's jobs feature, which fails to enforce authorization. It allows remote attackers to disclose sensitive information. The advisory record was updated on November 4, 2026.
- 2New MLflow vulnerability allows remote privilege escalationโ๐จ EUVD-2026-116621 ๐ Score: 6.3/10 (CVSS v3.1) ๐ฆ Product: MLflow ๐ข Vendor: mlflow ๐ Updated: 2026-11-04 ๐ MLflow Trackin
A security flaw tracked as EUVD-2026-116621 has been catalogued in MLflow, the open-source machine learning platform. The bug, scored 6.3 out of 10 on the CVSS v3.1 scale, stems from missing authorization in the MLflow Tracking Server and lets remote attackers escalate privileges on affected installations. It was updated in the European vulnerability database on 4 November 2026. Administrators running MLflow are being urged to review their deployments and apply fixes.