MLflow (mlflow server / mlflow ui, Model Registry): REMOTE FILE ACCESS on the host running the tracking and registry

Impact

REMOTE FILE ACCESS on the host running the tracking and registry server. Anyone who can query an mlflow server or mlflow ui instance below 2.3.1 can traverse to files outside the intended artifact path. In an AI cluster the tracking server is a high-value target precisely because it is boring infrastructure: it typically holds or can reach object-store credentials, database connection strings, and the pointers to every team's model artifacts, and it is very often deployed on an internal network with no auth in front of it on the theory that it is 'just experiment tracking'. Reading files off that host converts into credentials for the artifact store, and from there into the ability to plant models that other pipelines will load and execute. Affects only deployments that actually run the mlflow server or mlflow ui commands; managed offerings that do not invoke them are out of scope.

Who can reach it

Network, unauthenticated in the common deployment. Anyone able to send requests to the tracking or registry server is in scope — which is everyone, unless the operator has separately put a VPC boundary, IP allowlist or auth middleware in front of it, since MLflow ships none.

What to do

Upgrade MLflow to 2.3.1 or later and restart the tracking/registry servers. Independently of the patch, put an actual authentication and authorization layer in front of MLflow and restrict inbound access by network policy or IP allowlist — the vendor's own guidance is that these servers are not designed to be exposed. Rotate any credentials reachable from the server host if it has been broadly reachable.

References

Related entries

• ClearML API server: CSRF against the API serverCVE-2024-24593 · ClearML API serverCritical
• llama-cpp-python: RCE via Jinja2 template in a GGUF model's metadata (`Llama` class)CVE-2024-34359 · llama-cpp-pythonCritical
• Jupyter Server Proxy: Unauthenticated web access to a user's proxied processesCVE-2024-35225 · Jupyter Server ProxyCritical
• Langflow OSS: submitted components run arbitrary Python as root on the serverCVE-2026-12944 · IBM Langflow OSS (component code validation / sandbox)Critical
• Transformers: LightGlue config re-enables trust_remote_code from the model repo, executing repo code at loadCVE-2026-5241 · Hugging Face Transformers 5.2.0 (LightGlue config loading, trust_remote_code propagation)Critical
• GitLab MCP server: attacker-supplied API URL header exfiltrates the configured GitLab tokenCVE-2026-61559 · @zereight/mcp-gitlab MCP server (X-GitLab-API-URL dynamic base URL)Critical