EUVD-2026-34245
GHSA-5qmp-p3c4-72qj
Severity by source
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (vuldb) · only source for this CVE.
CVSS VectorVendor: vuldb
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2Blast Radius
ecosystem impact- 16 pypi packages depend on mlflow (16 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.10.1.
DescriptionCVE.org
A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.
AnalysisAI
Dataset digest computation in MLflow up to version 3.10.0 uses MD5 - a cryptographically broken algorithm - to fingerprint datasets, enabling a local attacker to craft colliding inputs that undermine dataset integrity tracking. Affected functions include compute_pandas_digest, compute_numpy_digest, and hash_dict_of_arrays in mlflow/data/digest_utils.py, which use a truncated 8-character MD5 digest that further reduces the collision space. Publicly available exploit code exists; this vulnerability is not confirmed actively exploited per CISA KEV, and the CVSS 4.0 score of 1.1 reflects the constrained local-only attack surface.
Technical ContextAI
The vulnerability resides in mlflow/data/digest_utils.py, where the get_normalized_md5_digest function uses hashlib.md5(usedforsecurity=False) and returns only the first 8 characters of the hex digest for dataset fingerprinting. CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) identifies MD5 as unsuitable for integrity assurance due to well-documented collision attacks. The 8-character truncation reduces the effective digest space to 32 bits, compounding the weakness. Additionally, the original implementation only sampled the head rows of large DataFrames and excluded non-string/non-numeric columns, creating further collision opportunities. The proposed fix in PR #22420 replaces MD5 with SHA-256, expands the digest to 32 characters, shifts to head+tail sampling, and incorporates column names and dtype metadata to harden against crafted collision inputs. No CPE strings were included in the provided input data; affected product is MLflow Python package versions up to and including 3.10.0.
RemediationAI
No vendor-released patch has been identified at time of analysis. An upstream fix is available as an unmerged pull request at https://github.com/mlflow/mlflow/pull/22420; the patched release version has not been independently confirmed because MLflow had not merged the PR at time of reporting. Organizations with a high sensitivity to ML pipeline integrity can manually apply the patch from PR #22420, which replaces MD5 with SHA-256, extends the digest length to 32 characters, and adds head+tail sampling plus dtype metadata - note this change will alter existing digest values for previously logged datasets, potentially breaking lineage continuity checks. As a compensating control without code modification, restrict local system access to the MLflow tracking server and audit who can write datasets to the registry, since the attack requires local host access with at least low-privilege credentials. Monitor the PR and MLflow release notes for an official patched version.
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. Rated critical severity (CVSS 9.6), t
mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass
A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of specia
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today