Home

Description

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. This issue affects MLflow version through 3.10.1

PUBLISHED Reserved 2026-03-24 | Published 2026-04-07 | Updated 2026-04-14 | Assigner CERT-PL




MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

Any version
affected

Credits

Sławomir Zakrzewski (AFINE) finder

References

github.com/mlflow/mlflow/pull/21435 patch

cert.pl/en/posts/2026/04/CVE-2026-33865/ third-party-advisory

afine.com/...g-mlflow-how-ml-artifacts-become-attack-vectors exploit technical-description

cve.org (CVE-2026-33865)

nvd.nist.gov (CVE-2026-33865)

Download JSON