CVE-2026-33865

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. This issue affects MLflow version through 3.10.1

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors	Exploit Third Party Advisory
https://cert.pl/en/posts/2026/04/CVE-2026-33865/	Third Party Advisory
https://github.com/mlflow/mlflow/pull/21435	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*

History

20 Apr 2026, 18:44

Type	Values Removed	Values Added
First Time		Lfprojects mlflow Lfprojects
CPE		cpe:2.3:a:lfprojects:mlflow::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.4
References	~~() https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors -~~	() https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors - Exploit, Third Party Advisory
References	~~() https://cert.pl/en/posts/2026/04/CVE-2026-33865/ -~~	() https://cert.pl/en/posts/2026/04/CVE-2026-33865/ - Third Party Advisory
References	~~() https://github.com/mlflow/mlflow/pull/21435 -~~	() https://github.com/mlflow/mlflow/pull/21435 - Issue Tracking, Patch

09 Apr 2026, 14:16

Type	Values Removed	Values Added
References		() https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors -

07 Apr 2026, 13:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-07 13:16

Updated : 2026-04-20 18:44

NVD link : CVE-2026-33865

Mitre link : CVE-2026-33865

CVE.ORG link : CVE-2026-33865

JSON object : View

Products Affected

lfprojects

mlflow

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-33865", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2026-04-07T13:16:46.840", "references": [{"url": "https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors", "tags": ["Exploit", "Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://cert.pl/en/posts/2026/04/CVE-2026-33865/", "tags": ["Third Party Advisory"], "source": "cvd@cert.pl"}, {"url": "https://github.com/mlflow/mlflow/pull/21435", "tags": ["Issue Tracking", "Patch"], "source": "cvd@cert.pl"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. \n\nThis issue affects MLflow version through 3.10.1"}], "lastModified": "2026-04-20T18:44:12.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1C49CD5-5BB0-422B-9A71-5A6832DF6713", "versionEndIncluding": "3.10.1"}], "operator": "OR"}]}], "sourceIdentifier": "cvd@cert.pl"}