CVE-2025-15379: A command injection vulnerability exists in MLflow's model serving container initialization code, specifically

This week

CRITICAL 10.0REMOTEUPGRADE

CVE-2025-15379 is a critical-severity flaw (CVSS 10.0) affecting mlflow. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency specifications from the model artifact's `python_env.yaml` file and directly interpolates them into a shell command without sanitization. This allows an attacker to supply a malicious model artifact and achieve

Why this priority

Critical severity
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	2.4% (top 16%)
CISA exploited list	No
Weakness	CWE-77, CWE-78
Published	2026-03-30
Last modified	2026-09-04

Publisher (CNA): huntr.dev · Vendor: lfprojects

Last updated 2026-09-04 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-03-30 08:16 UTCPublished CVE record published
2026-09-04 20:02 UTCUpdated Record last modified

lfprojects mlflow UPGRADE

Affected: >= 3.8.0 and < 3.8.1

Fixed in: 3.8.1

Safe to downgrade to: a release before 3.8.0

1. Check installed version

apt-cache policy mlflow || rpm -q mlflow || mlflow --version

2. UPGRADE to 3.8.1 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade mlflow

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade mlflow

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 3.8.0 (Debian / Ubuntu)

apt-cache madison mlflow sudo apt install mlflow=<VERSION_BEFORE_3.8.0> sudo apt-mark hold mlflow

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list mlflow sudo dnf downgrade mlflow-<VERSION_BEFORE_3.8.0> sudo dnf versionlock add mlflow

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Python (pip) · mlflow · FIXED · 3.8.1 · vulnerable: < 3.8.1 · source

pip install --upgrade "mlflow>=3.8.1" pip show mlflow

Fedora ELN · perl-Encode · FIXED · 3.25-528.eln159 · FEDORA-2026-79991d0238 · source

sudo dnf upgrade --advisory=FEDORA-2026-79991d0238

Fedora 46 · fonttools · FIXED · 4.68.0-1.fc46 · FEDORA-2026-65d6c01c75 · source

sudo dnf upgrade --advisory=FEDORA-2026-65d6c01c75

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-15379?

mlflow: upgrade to 3.8.1. Exact commands for each OS are on this page.

Is CVE-2025-15379 being exploited?

CVE-2025-15379 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-15379 affect?

CVE-2025-15379 affects mlflow. Severity is critical (CVSS 10.0). A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_manager=LOCAL`, MLflow reads dependency

How urgent is CVE-2025-15379?

Priority 69/100. Critical severity; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Python vulnerabilities

Related CVEs

CVE-2026-64849 CRITICAL 9.3 EXPLOITED UPGRADE MLflow Server-Side Request Forgery Vulnerability
CVE-2026-8147 HIGH 8.1 UPGRADE In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack pro
CVE-2026-2611 CRITICAL 9.6 UPGRADE In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api e
CVE-2025-15381 HIGH 7.1 MITIGATE In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints
CVE-2026-2614 HIGH 7.5 UPGRADE A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versi

References

← Back to latest CVEs