What’s Vulnerable › Vulnerabilities

CVE-2025-14279: DNS Rebinding Vulnerability in mlflow/mlflow

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-12 · updated 2026-06-17
• Weakness: CWE-346

Description

MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.

Affected products

• mlflow/mlflow: before 3.5.0 — fixed in 3.5.0

How to fix

Upgrade to a fixed version: mlflow/mlflow 3.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/mlflow/mlflow/commit/b0ffd289e9b0d0cc32c9e3a9b9f3843ae83dbec3
• https://huntr.com/bounties/ef478f72-2e4f-44dc-8055-fc06bef03108

Get alerted when CVE-2025-14279 or the next vulnerability affects your stack