CVE-2025-14279 json
DNS Rebinding Vulnerability in mlflow/mlflow
published 2026-01-12 9 mo ago modified 2026-09-10 1 mo ago also BIT-mlflow-2025-14279 , EUVD-2026-1944 , GHSA-pgqp-8h46-6x4j , PYSEC-2026-1656
- cvss
- 8.1
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 12%
- public exploits
- 0
- none known
Summary
MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vulnerability allows malicious websites to bypass Same-Origin Policy protections and execute unauthorized calls against REST endpoints. An attacker can query, update, and delete experiments via the affected endpoints, leading to potential data exfiltration, destruction, or manipulation. The issue is resolved in version 3.5.0.
Patch / fix
- pypi mlflow 3.5.0
- bitnami mlflow 3.5.0
- mlflow mlflow/mlflow 3.5.0
- github.com/mlflow/mlflow@b0ffd28 commit
- github.com/mlflow/mlflow#17910 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 9 mo ago
Exploit prediction
0.22% chance of exploitation in the next 30 days, higher than 12% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/ef478f72-2e4f-44dc-8055-fc06bef03108 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| GitHub | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| OSV | 3.0 | 8.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mlflow | <3.5.0 |
3.5.0 |
| bitnami | mlflow | <3.5.0 |
3.5.0 |
Affected products
- mlflow mlflow/mlflow
Classification
- Weakness
-
- CWE-346 Origin Validation Error
References
-
github.com
/mlflow/mlflow/commit/b0ffd289e9b0d0cc32c9e3a9b9f3843ae83dbec3
web, patch
-
github.com
/mlflow/mlflow/pull/17910
web
-
huntr.com
/bounties/ef478f72-2e4f-44dc-8055-fc06bef03108
web, exploit, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-14279
advisory, web
-
github.com
/mlflow/mlflow
package
-
pypi.org
/project/mlflow
package
-
github.com
/advisories/GHSA-pgqp-8h46-6x4j
advisory
Sources
- CVE List CVE-2025-14279
- GitHub Advisory GHSA-pgqp-8h46-6x4j
- NVD CVE-2025-14279
- OSV BIT-mlflow-2025-14279
- OSV PYSEC-2026-1656
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.