CVE-2026-2734
2 advisories.
PyPI/mlflow CVE-2026-2734: medium 6.5
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
Action: Upgrade mlflow to 3.10.0 or later.
pip install mlflow==3.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.10.0 | - |
Fixed versions
| 3.10.0 |
Sources
- osv: GHSA-w5xq-c4pf-ghq7
- https://nvd.nist.gov/vuln/detail/CVE-2026-2734
- https://github.com/mlflow/mlflow/commit/6989066af33fdcb03588fd71a1a67f8fc5ef12c9
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/d632f783-b2c7-4a3b-af5e-1d693e841c08
CVE-2026-2734 · published · modified · JSON
PyPI/mlflow CVE-2026-2734: medium 6.5
MLflow authenticated users can enumerate any registered model versions due to lack of per-model permissions checks
Action: Upgrade mlflow to 3.10.0 or later.
pip install mlflow==3.10.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.10.0 | - |
Fixed versions
| 3.10.0 |
Sources
- osv: PYSEC-2026-2660
- https://nvd.nist.gov/vuln/detail/CVE-2026-2734
- https://github.com/mlflow/mlflow/commit/6989066af33fdcb03588fd71a1a67f8fc5ef12c9
- https://github.com/mlflow/mlflow
- https://huntr.com/bounties/d632f783-b2c7-4a3b-af5e-1d693e841c08
- https://pypi.org/project/mlflow
- https://github.com/advisories/GHSA-w5xq-c4pf-ghq7
CVE-2026-2734 · published · modified · JSON