CVE-2026-0596
2 advisories.
PyPI/mlflow CVE-2026-0596: critical 9.6
Mlflow: Command Injection when serving models with enable_mlserver=True
Action: Upgrade mlflow to 3.9.0 or later.
pip install mlflow==3.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.9.0 | - |
Fixed versions
| 3.9.0 |
Sources
- osv: GHSA-rvhj-8chj-8v3c
- https://nvd.nist.gov/vuln/detail/CVE-2026-0596
- https://github.com/mlflow/mlflow/pull/19738
- https://github.com/mlflow/mlflow/commit/202fac4c83ccc8544c087c142b80196d0e60695c
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/2e905add-f9f5-4309-a3db-b17de5981285
CVE-2026-0596 · published · modified · JSON
PyPI/mlflow CVE-2026-0596: critical 9.6
Mlflow: Command Injection when serving models with enable_mlserver=True
Action: Upgrade mlflow to 3.9.0 or later.
pip install mlflow==3.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.9.0 | - |
Fixed versions
| 3.9.0 |
Sources
- osv: PYSEC-2026-424
- https://nvd.nist.gov/vuln/detail/CVE-2026-0596
- https://github.com/mlflow/mlflow/pull/19738
- https://github.com/mlflow/mlflow/commit/202fac4c83ccc8544c087c142b80196d0e60695c
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/2e905add-f9f5-4309-a3db-b17de5981285
- https://pypi.org/project/mlflow
- https://github.com/advisories/GHSA-rvhj-8chj-8v3c
CVE-2026-0596 · published · modified · JSON