Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

MLflow allows unauthorized access to multipart upload endpoints when the `--serve-artifacts` mode is enabled

Fix availableCritical · CVSS 9EPSS 0.54%

Published May 26, 2026 · updated Oct 6, 2026

What to do

  1. Upgrade to a fixed version: mlflow 3.10.0.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPImlflow

Vulnerable versions
< 3.10.0
Fixed in
3.10.0

Check your project: pip show mlflow

Sources

CWE-862 Missing Authorization · CWE-1220 Insufficient Granularity of Access Control

← All critical vulnerabilities