CVE Explorer
CVE-2026-33865
MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.
This issue affects MLflow version through 3.10.1
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://github.com","defaultStatus":"unaffected","packageName":"mlfolw","product":"Mlflow","repo":"https://github.com/mlflow/","vendor":"Mlflow","versions":[{"lessThanOrEqual":"3.10.1","status":"affected","version":"0","versionType":"semver"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:3b812ab2c55a25e72874e28527d37ddbe63bb1619a16141c0891d639543bd0d3 · sha256:b27f01948335ce8f… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":5.1,"baseSeverity":"MEDIUM","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"L…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:3b812ab2c55a25e72874e28527d37ddbe63bb1619a16141c0891d639543bd0d3 · sha256:b27f01948335ce8f… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:3b812ab2c55a25e72874e28527d37ddbe63bb1619a16141c0891d639543bd0d3 · sha256:b27f01948335ce8f… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"tags":["exploit","technical-description"],"url":"https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3b812ab2c55a25e72874e28527d37ddbe63bb1619a16141c0891d639543bd0d3 · sha256:b27f01948335ce8f… · /containers/cna/references/2
{"tags":["third-party-advisory"],"url":"https://cert.pl/en/posts/2026/04/CVE-2026-33865/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3b812ab2c55a25e72874e28527d37ddbe63bb1619a16141c0891d639543bd0d3 · sha256:b27f01948335ce8f… · /containers/cna/references/1
{"tags":["patch"],"url":"https://github.com/mlflow/mlflow/pull/21435"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:3b812ab2c55a25e72874e28527d37ddbe63bb1619a16141c0891d639543bd0d3 · sha256:b27f01948335ce8f… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.