mlflow 3.17.1 : vulnérabilités connues

Impossible de comparer 19 entrées. Les résultats sont incomplets.

1. CVE-2026-53995

   Élevée · CVSS 8.8EPSS 0,6%Code d’exploitation publicCorrectif disponible

   MLflow 3.17.1 and prior Path Traversal via Trace ID API

   MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so d

   mlflowPython

   • Mettez à jour vers 3.17.2

   Publication 19 octobre 2026Mise à jour 27 octobre 2026

   Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗