CVE-2026-33865

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim.

This issue affects MLflow version through 3.10.1

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Mlflow	Mlflow	<= 3.10.1

References

https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectorsExploit, Third Party Advisory
https://cert.pl/en/posts/2026/04/CVE-2026-33865/Third Party Advisory
https://github.com/mlflow/mlflow/pull/21435Issue Tracking, Patch

Timeline

Published: Apr 7, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-338664.3MLflow is vulnerable to an authorization bypass affecting the AJAX endpoint used to download saved model artifacts. Due to missing access‑co CVE-2026-338677.5WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individ CVE-2026-338686.1Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated CVE-2026-338694.8Mastodon is a free, open-source social network server based on ActivityPub. In versions on the 4.5.x branch prior to 4.5.8 and on the 4.4.x CVE-2026-33875.5A vulnerability has been found in wren-lang wren up to 0.4.0. Affected by this issue is the function getByteCountForArguments of the file sr CVE-2026-338707.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, Netty incorrectly CVE-2026-338717.5Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.132.Final and 4.2.10.Final, a remote user can CVE-2026-338727.1elixir-nodejs provides an Elixir API for calling Node.js functions. A vulnerability in versions prior to 3.1.4 results in Cross-User Data Le CVE-2026-338739.9Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.9.0, the Agentic Assistant feature in Lang CVE-2026-338747.8Gematik Authenticator securely authenticates users for login to digital health applications. Starting in version 4.12.0 and prior to version CVE-2026-338759.3Gematik Authenticator securely authenticates users for login to digital health applications. Versions prior to 4.16.0 are vulnerable to auth CVE-2026-338773.7ApostropheCMS is an open-source Node.js content management system. Versions 4.28.0 and prior contain a timing side-channel vulnerability in