ZDI publishes nine MLflow advisories; fixes and exploitation unstated
First merged summary.
ZDI published nine MLflow advisories on October 29, 2026, without versions, patches, or known attacks.
The Zero Day Initiative published nine MLflow advisories on October 29, 2026. Three deserialization flaws can lead to remote code execution if a user opens a malicious page or file: ZDI-26-839 (CVE-2026-118623), ZDI-26-843 (CVE-2026-118627), and ZDI-26-845 (CVE-2024-37052), each scored 7.8. The highest score is 8.2 for unauthenticated get-artifacts SSRF (ZDI-26-844, CVE-2026-118628). Authenticated SSRF, missing-authorization privilege escalation, and information disclosure are also listed. ZDI does not name affected or fixed versions or known exploitation.
- Highest score is CVSS 8.2 for unauthenticated get-artifacts SSRF, CVE-2026-118628.
- Three RCE deserialization flaws each require user interaction and are scored 7.8.
- AI Gateway SSRF CVE-2026-71211 is scored 7.7 and requires authentication.
- Webhook SSRF CVE-2026-64849 is scored 6.8 and requires authentication.
- Tracking Server flaws: CVE-2026-118625 at 6.3; CVE-2026-118624 and CVE-2026-118626 at 5.4.
- ZDI states no affected versions, patches, or known attacks.
Timeline
dated events in the reporting · oldest first- Oct 29, 2026ZDI publishes nine MLflow security advisories · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesMaps nine advisory IDs to CVEs, scores, and attack preconditions
- CVEs
- CVE-2026-118627CVE-2026-118628CVE-2024-37052CVE-2026-71211CVE-2026-118623CVE-2026-64849CVE-2026-118625CVE-2026-118626CVE-2026-118624
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 1d ago
ZDI Published AdvisoriesFirst report
Unauthenticated MLflow get-artifacts SSRF leaks data (CVE-2026-118628)
ZDI rates the flaw 8.2; the snippet gives no affected versions, fix, or exploitation status.
- · 1d ago
MLflow Tracking Server missing authorization allows privilege escalation
Authenticated remote attackers can escalate privileges; ZDI scores CVE-2026-118625 at CVSS 6.3.
- · 1d ago
MLflow Tracking Server jobs flaw can disclose sensitive information
Authenticated remote attackers can read sensitive data; ZDI rates CVE-2026-118624 at CVSS 5.4.
- · 1d ago
MLflow pickle evaluation artifact deserialization allows remote code execution
A user must open a malicious page or file; ZDI rates CVE-2026-118623 at CVSS 7.8.
- · 1d ago
MLflow AI Gateway SSRF can leak data if authenticated (CVE-2026-71211)
ZDI rates the authenticated flaw 7.7; the snippet does not name versions or a patch.
- · 1d ago
MLflow SHAP load_explainer bug allows RCE (CVE-2026-118627)
ZDI rates the deserialization flaw 7.8 and says the victim must open a malicious page or file.
- · 1d ago
MLflow Statsmodels load can run code after user action (CVE-2024-37052)
The target must open a malicious page or file; ZDI rates the flaw CVSS 7.8.
- · 1d ago
MLflow Tracking Server issues missing authorization allows privilege escalation
Authenticated remote attackers can raise privileges; ZDI rates CVE-2026-118626 at CVSS 5.4, with no fix listed.
- · 1d ago
Authenticated MLflow webhook SSRF rated CVSS 6.8 (CVE-2026-64849)
Logged-in attackers can make the server send arbitrary requests; versions and a fix are not given.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-37052 | Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn… | 8.8 | <1% | PoC | |
| CVE-2026-118623 | — | — | — | ||
| CVE-2026-118624 | — | — | — | ||
| CVE-2026-118625 | — | — | — | ||
| CVE-2026-118626 | — | — | — | ||
| CVE-2026-118627 | — | — | — | ||
| CVE-2026-118628 | — | — | — | ||
| CVE-2026-64849 | Unauthenticated SSRF in MLflow Exposes Cloud Credentials and Secrets | 9.3 | 10% | KEVPoC ×5 | KEV |
| CVE-2026-71211 | MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation… | 7.1 | <1% |