PYSEC-2026-420
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/mlflow/PYSEC-2026-420.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-420
- Aliases
- Published
- 2026-06-29T11:50:43.209628Z
- Modified
- 2026-07-01T20:22:58.313071Z
- Severity
-
- 10.0 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- MLflow allowed arbitrary files to be PUT onto the server
- Details
-
MLflow allowed arbitrary files to be PUT onto the server.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2023-6015
- https://github.com/mlflow/mlflow/pull/10330
- https://github.com/mlflow/mlflow/commit/cf83dad4df26dd4a850622fe8a51ccab1471a5e7
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/43e6fb72-676e-4670-a225-15d6836f65d3
- https://pypi.org/project/mlflow
- https://github.com/advisories/GHSA-f798-qm4r-23r5
Affected packages
PyPI / mlflow
Package
- Name
- mlflow
- View open source insights on deps.dev
- Purl
- pkg:pypi/mlflow
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.8.1
Affected versions
0.*
0.0.1
0.1.0
0.2.0
0.2.1
0.3.0
0.4.0
0.4.1
0.4.2
0.5.0
0.5.1
0.5.2
0.6.0
0.7.0
0.8.0
0.8.1
0.8.2
0.9.0
0.9.0.1
0.9.1
1.*
1.0.0
1.1.0
1.1.1.dev0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.7.1
1.7.2
1.8.0
1.9.0
1.9.1
1.10.0
1.11.0
1.12.0
1.12.1
1.13
1.13.1
1.14.0
1.14.1
1.15.0
1.16.0
1.17.0
1.18.0
1.19.0
1.20.0
1.20.1
1.20.2
1.21.0
1.22.0
1.23.0
1.23.1
1.24.0
1.25.0
1.25.1
1.26.0
1.26.1
1.27.0
1.28.0
1.29.0
1.30.0
1.30.1
2.*
2.0.0rc0
2.0.0
2.0.1
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.5.0
2.6.0
2.7.0
2.7.1
2.8.0