PyPI/mlflow CVE-2025-52967: medium 5.8, EPSS 0.44%
MLFlow SSRF via gateway_proxy_handler
Action: Upgrade mlflow to 2.22.2 or later.
pip install mlflow==3.1.0pip install mlflow==2.22.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.0.0rc0 | 3.1.0 | - |
| 0 | 2.22.2 | - |
Fixed versions
| 3.1.0 | 2.22.2 |
Sources
- osv: GHSA-wxj7-3fx5-pp9m
- https://nvd.nist.gov/vuln/detail/CVE-2025-52967
- https://github.com/mlflow/mlflow/issues/15944
- https://github.com/mlflow/mlflow/pull/15970
- https://github.com/mlflow/mlflow
- https://github.com/mlflow/mlflow/releases/tag/v2.22.2
- https://github.com/mlflow/mlflow/releases/tag/v3.1.0
- https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2025-52.yaml
CVE-2025-52967 · published · modified · JSON