Sieve내 스택에 해당하는 LLM 보안 이슈만검색 /

검색

30건 · AI 관련·실제 악용·최신 순

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

PyPI mlflow · 3.15.0에서 수정 · GHSA-7gwp-5pfp-969j · 2026. 10. 3.

높음실제 악용

MLflow Server-Side Request Forgery Vulnerability

CVE-2026-64849 · KEV-CVE-2026-64849 · 2026. 8. 19.

중간취약점

MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints

PyPI mlflow · 3.17.0에서 수정 · GHSA-2wqp-q3c6-ccj5 · 2026. 10. 29.

높음취약점

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

PyPI mlflow · 3.17.0에서 수정 · GHSA-m65p-9j7q-6w33 · 2026. 10. 28.

중간취약점

MLflow CrewAI autologging records LLM provider API keys in logged trace spans

PyPI mlflow · 3.17.0에서 수정 · GHSA-j7qq-vr8c-xvw3 · 2026. 10. 28.

치명취약점

MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules

PyPI mlflow · 3.17.0에서 수정 · GHSA-26p8-2jq9-3vq9 · 2026. 10. 28.

높음취약점

MLflow FileStore trace IDs allow path traversal and arbitrary file writes

PyPI mlflow · 3.17.2에서 수정 · GHSA-wqmh-qccw-pqwf · 2026. 10. 26.

치명취약점

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

PyPI mlflow · 3.10.0에서 수정 · GHSA-8c7q-86fq-vvmh · 2026. 10. 7.

치명취약점

MLflow: Improper Origin Validation in MLflow Assistant /ajax-api Endpoints Enables Browser-Mediated Local Command Execution

PyPI mlflow · 3.10.0에서 수정 · GHSA-67c5-x5mf-rppq · 2026. 10. 6.

높음취약점

MLflow AI Gateway permits SSRF through an unvalidated api_base

PyPI mlflow · 수정 버전 없음 · GHSA-h7x2-h6g9-p789 · 2026. 9. 10.

치명취약점

mlflow: FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization

PyPI mlflow · 수정 버전 없음 · GHSA-7qhf-v65m-g5f3 · 2026. 9. 10.

높음취약점

MLflow has a command injection in mlflow/sagemaker/__init__.py

PyPI mlflow · 3.8.0rc0에서 수정 · GHSA-xch3-2f9x-wh9f · 2026. 9. 10.

치명취약점

MLFlow path traversal vulnerability

PyPI mlflow · 3.9.0rc0에서 수정 · GHSA-vhcx-3pq2-4fvc · 2026. 9. 10.

높음취약점

Arbitrary file write via tar traversal in mlflow

PyPI mlflow · 3.9.0rc0에서 수정 · GHSA-fhff-qmm8-h2fp · 2026. 9. 10.

높음취약점

MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability

PyPI mlflow · 3.8.0rc0에서 수정 · GHSA-q2r8-vmq7-fpx2 · 2026. 9. 10.

중간취약점

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface

PyPI mlflow · 3.11.1에서 수정 · GHSA-fh64-r2vc-xvhr · 2026. 9. 10.

중간취약점

MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint

PyPI mlflow · 3.11.0rc0에서 수정 · GHSA-46r5-x6jq-v8g6 · 2026. 9. 10.

치명취약점

MLflow Command Injection vulnerability

PyPI mlflow · 3.8.1에서 수정 · GHSA-r23q-823p-vmf7 · 2026. 9. 10.

높음취약점

MLFlow allows Tracing + Assessments Access

PyPI mlflow · 수정 버전 없음 · GHSA-g6pg-52vf-843h · 2026. 9. 10.

치명취약점

MLflow Use of Default Password Authentication Bypass Vulnerability

PyPI mlflow · 3.8.0rc0에서 수정 · GHSA-gq3w-7jj3-x7gr · 2026. 9. 10.

높음취약점

mlflow Creates of Temporary File in Directory with Insecure Permissions

PyPI mlflow · 3.4.0rc0에서 수정 · GHSA-4x5p-f36r-mxxr · 2026. 9. 10.

높음취약점

MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation

PyPI mlflow · 3.5.0에서 수정 · GHSA-pgqp-8h46-6x4j · 2026. 9. 10.

높음취약점

MLFlow unsafe deserialization

PyPI mlflow · 수정 버전 없음 · GHSA-wf7f-8fxf-xfxc · 2026. 9. 10.

높음취약점

MLFlow improper input validation

PyPI mlflow · 수정 버전 없음 · GHSA-pqcv-qw2r-r859 · 2026. 9. 10.

높음취약점

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

PyPI mlflow · 3.15.0에서 수정 · GHSA-gqvg-gmmx-x4hm · 2026. 9. 2.

높음취약점

MLFlow Creates a Temporary File With Insecure Permissions

PyPI mlflow · 3.11.0에서 수정 · GHSA-f2m9-wcf4-cwwx · 2026. 9. 1.

높음취약점

MLflow: trace API endpoints lack proper authorization validators

PyPI mlflow · 3.13.0rc0에서 수정 · GHSA-2cm6-r77w-6g96 · 2026. 8. 19.

낮음취약점

MLflow: Deterministic sampling in dataset digest enables predictable collisions

PyPI mlflow · 3.10.1에서 수정 · GHSA-5qmp-p3c4-72qj · 2026. 7. 16.

중간취약점

MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks

PyPI mlflow · 3.10.0에서 수정 · GHSA-w5xq-c4pf-ghq7 · 2026. 7. 14.

높음취약점

MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem

PyPI mlflow · 3.10.0에서 수정 · GHSA-42h5-h8qh-vv9v · 2026. 7. 14.