{"schema_version":"2","view":"grouped","data":[{"id":70964,"cve_ids":["CVE-2026-64849"],"payload":{"kind":"advisory","title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","summary":"### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://169.254.169.254/...` (or `http://127.0.0.1:...`); MLflow follows it and never re-validates the redirect target. Because `/test` reflects the response body, this is an unauthenticated full-read SSRF on a default server. ### Details Three facts combine: 1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (`mlflow/server/auth/__init__.py`, `WEBHOOK_BEFORE_REQUEST_HANDLERS`), which is not loaded by default. 2. The guard validates but pins nothing — `mlflow/utils/validation.py` `_validate_webhook_url`: ```python schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get() # default [\"https\"] if parsed_url.scheme not in schemes: raise ... if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get(): # default False for addr_info in socket.getaddrinfo(hostname, None): ip = ipaddress.ip_addre","evidence":"osv:GHSA-7gwp-5pfp-969j","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.10.0","evidence":"/affected/0/versions"},{"value":"3.10.0rc0","evidence":"/affected/0/versions"},{"value":"3.10.1","evidence":"/affected/0/versions"},{"value":"3.11.0","evidence":"/affected/0/versions"},{"value":"3.11.0rc0","evidence":"/affected/0/versions"},{"value":"3.11.0rc1","evidence":"/affected/0/versions"},{"value":"3.11.1","evidence":"/affected/0/versions"},{"value":"3.12.0","evidence":"/affected/0/versions"},{"value":"3.12.0rc0","evidence":"/affected/0/versions"},{"value":"3.13.0","evidence":"/affected/0/versions"},{"value":"3.13.0rc0","evidence":"/affected/0/versions"},{"value":"3.14.0","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"},{"value":"3.3.2","evidence":"/affected/0/versions"},{"value":"3.4.0","evidence":"/affected/0/versions"},{"value":"3.4.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.0","evidence":"/affected/0/versions"},{"value":"3.5.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.1","evidence":"/affected/0/versions"},{"value":"3.6.0","evidence":"/affected/0/versions"},{"value":"3.6.0rc0","evidence":"/affected/0/versions"},{"value":"3.7.0","evidence":"/affected/0/versions"},{"value":"3.7.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.0","evidence":"/affected/0/versions"},{"value":"3.8.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.1","evidence":"/affected/0/versions"},{"value":"3.9.0","evidence":"/affected/0/versions"},{"value":"3.9.0rc0","evidence":"/affected/0/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7gwp-5pfp-969j","aliases":["BIT-mlflow-2026-64849","CVE-2026-64849","GHSA-7gwp-5pfp-969j","PYSEC-2026-3687"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.15.0"}]}],"package":{"name":"mlflow","purl":"pkg:pypi/mlflow","ecosystem":"PyPI"},"versions":["3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.13.0","3.13.0rc0","3.14.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7gwp-5pfp-969j/GHSA-7gwp-5pfp-969j.json"}}],"modified":"2026-10-02T18:30:39.856988982Z","provider":"osv","references":["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","https://nvd.nist.gov/vuln/detail/CVE-2026-64849","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/pull/24258","https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","https://github.com/advisories/GHSA-7gwp-5pfp-969j","https://github.com/mlflow/mlflow","https://github.com/mlflow/mlflow/releases/tag/v3.15.0","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.yaml","https://pypi.org/project/mlflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2026-08-17T22:17:23Z","github_reviewed_at":"2026-08-17T21:58:51Z"}},"related_cves":[{"value":"CVE-2026-64849","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7gwp-5pfp-969j","priority":{"reasons":["publisher_severity","linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-64849","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"mlflow","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64849","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-64849","metrics":[],"products":[{"name":{"value":"MLflow","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7gwp-5pfp-969j","advisory_id":"5fe1fa61-7fc5-45f7-b11a-9586f3d40a1f","event_types":["advisory"],"published_at":"2026-10-25T22:45:50.32144+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T21:58:51+00:00","detail_url":"/advisories/osv%3AGHSA-7gwp-5pfp-969j","group":{"id":"osv:GHSA-7gwp-5pfp-969j","revision":1,"primary_event_id":71335,"change":"published","superseded_by":[],"changed":{"id":71335,"cve_ids":["CVE-2026-64849"],"payload":{"kind":"advisory","title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","summary":"### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://169.254.169.254/...` (or `http://127.0.0.1:...`); MLflow follows it and never re-validates the redirect target. Because `/test` reflects the response body, this is an unauthenticated full-read SSRF on a default server. ### Details Three facts combine: 1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (`mlflow/server/auth/__init__.py`, `WEBHOOK_BEFORE_REQUEST_HANDLERS`), which is not loaded by default. 2. The guard validates but pins nothing — `mlflow/utils/validation.py` `_validate_webhook_url`: ```python schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get() # default [\"https\"] if parsed_url.scheme not in schemes: raise ... if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get(): # default False for addr_info in socket.getaddrinfo(hostname, None): ip = ipaddress.ip_addre","evidence":"osv:GHSA-7gwp-5pfp-969j","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.10.0","evidence":"/affected/0/versions"},{"value":"3.10.0rc0","evidence":"/affected/0/versions"},{"value":"3.10.1","evidence":"/affected/0/versions"},{"value":"3.11.0","evidence":"/affected/0/versions"},{"value":"3.11.0rc0","evidence":"/affected/0/versions"},{"value":"3.11.0rc1","evidence":"/affected/0/versions"},{"value":"3.11.1","evidence":"/affected/0/versions"},{"value":"3.12.0","evidence":"/affected/0/versions"},{"value":"3.12.0rc0","evidence":"/affected/0/versions"},{"value":"3.13.0","evidence":"/affected/0/versions"},{"value":"3.13.0rc0","evidence":"/affected/0/versions"},{"value":"3.14.0","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"},{"value":"3.3.2","evidence":"/affected/0/versions"},{"value":"3.4.0","evidence":"/affected/0/versions"},{"value":"3.4.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.0","evidence":"/affected/0/versions"},{"value":"3.5.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.1","evidence":"/affected/0/versions"},{"value":"3.6.0","evidence":"/affected/0/versions"},{"value":"3.6.0rc0","evidence":"/affected/0/versions"},{"value":"3.7.0","evidence":"/affected/0/versions"},{"value":"3.7.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.0","evidence":"/affected/0/versions"},{"value":"3.8.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.1","evidence":"/affected/0/versions"},{"value":"3.9.0","evidence":"/affected/0/versions"},{"value":"3.9.0rc0","evidence":"/affected/0/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7gwp-5pfp-969j","aliases":["BIT-mlflow-2026-64849","CVE-2026-64849","GHSA-7gwp-5pfp-969j","PYSEC-2026-3687"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.15.0"}]}],"package":{"name":"mlflow","purl":"pkg:pypi/mlflow","ecosystem":"PyPI"},"versions":["3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.13.0","3.13.0rc0","3.14.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7gwp-5pfp-969j/GHSA-7gwp-5pfp-969j.json"}}],"modified":"2026-10-02T18:30:39.856988982Z","provider":"osv","references":["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","https://nvd.nist.gov/vuln/detail/CVE-2026-64849","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/pull/24258","https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","https://github.com/advisories/GHSA-7gwp-5pfp-969j","https://github.com/mlflow/mlflow","https://github.com/mlflow/mlflow/releases/tag/v3.15.0","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.yaml","https://pypi.org/project/mlflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2026-08-17T22:17:23Z","github_reviewed_at":"2026-08-17T21:58:51Z"}},"related_cves":[{"value":"CVE-2026-64849","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7gwp-5pfp-969j","priority":{"reasons":["publisher_severity","linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-64849","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"mlflow","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64849","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-64849","metrics":[],"products":[{"name":{"value":"MLflow","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7gwp-5pfp-969j","advisory_id":"5fe1fa61-7fc5-45f7-b11a-9586f3d40a1f","event_types":["advisory"],"published_at":"2026-10-25T22:45:50.32144+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T21:58:51+00:00","detail_url":"/events/71335"},"members":[{"id":71335,"cve_ids":["CVE-2026-64849"],"payload":{"kind":"advisory","title":"MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)","summary":"### Summary The default MLflow Tracking Server (`mlflow server`, no authentication, default SQLite backend) exposes the model-registry webhooks API unauthenticated, including a synchronous `POST /api/2.0/mlflow/webhooks/{id}/test` endpoint that returns the upstream response status and body to the caller. The SSRF guard added in PR #20747 (`_validate_webhook_url`, shipped in 3.10.0) resolves the webhook hostname and rejects non-public IPs, but it is bypassable: delivery follows HTTP redirects (no `allow_redirects=False`) and never pins the validated IP. An attacker hosts a public HTTPS endpoint that passes the guard and returns `302 Location: http://169.254.169.254/...` (or `http://127.0.0.1:...`); MLflow follows it and never re-validates the redirect target. Because `/test` reflects the response body, this is an unauthenticated full-read SSRF on a default server. ### Details Three facts combine: 1. Webhook endpoints are unauthenticated on a default server. The only webhook authorization lives in the optional auth plugin (`mlflow/server/auth/__init__.py`, `WEBHOOK_BEFORE_REQUEST_HANDLERS`), which is not loaded by default. 2. The guard validates but pins nothing — `mlflow/utils/validation.py` `_validate_webhook_url`: ```python schemes = _MLFLOW_WEBHOOK_ALLOWED_SCHEMES.get() # default [\"https\"] if parsed_url.scheme not in schemes: raise ... if not _MLFLOW_WEBHOOK_ALLOW_PRIVATE_IPS.get(): # default False for addr_info in socket.getaddrinfo(hostname, None): ip = ipaddress.ip_addre","evidence":"osv:GHSA-7gwp-5pfp-969j","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.10.0","evidence":"/affected/0/versions"},{"value":"3.10.0rc0","evidence":"/affected/0/versions"},{"value":"3.10.1","evidence":"/affected/0/versions"},{"value":"3.11.0","evidence":"/affected/0/versions"},{"value":"3.11.0rc0","evidence":"/affected/0/versions"},{"value":"3.11.0rc1","evidence":"/affected/0/versions"},{"value":"3.11.1","evidence":"/affected/0/versions"},{"value":"3.12.0","evidence":"/affected/0/versions"},{"value":"3.12.0rc0","evidence":"/affected/0/versions"},{"value":"3.13.0","evidence":"/affected/0/versions"},{"value":"3.13.0rc0","evidence":"/affected/0/versions"},{"value":"3.14.0","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"},{"value":"3.3.2","evidence":"/affected/0/versions"},{"value":"3.4.0","evidence":"/affected/0/versions"},{"value":"3.4.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.0","evidence":"/affected/0/versions"},{"value":"3.5.0rc0","evidence":"/affected/0/versions"},{"value":"3.5.1","evidence":"/affected/0/versions"},{"value":"3.6.0","evidence":"/affected/0/versions"},{"value":"3.6.0rc0","evidence":"/affected/0/versions"},{"value":"3.7.0","evidence":"/affected/0/versions"},{"value":"3.7.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.0","evidence":"/affected/0/versions"},{"value":"3.8.0rc0","evidence":"/affected/0/versions"},{"value":"3.8.1","evidence":"/affected/0/versions"},{"value":"3.9.0","evidence":"/affected/0/versions"},{"value":"3.9.0rc0","evidence":"/affected/0/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7gwp-5pfp-969j","aliases":["BIT-mlflow-2026-64849","CVE-2026-64849","GHSA-7gwp-5pfp-969j","PYSEC-2026-3687"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3.0"},{"fixed":"3.15.0"}]}],"package":{"name":"mlflow","purl":"pkg:pypi/mlflow","ecosystem":"PyPI"},"versions":["3.10.0","3.10.0rc0","3.10.1","3.11.0","3.11.0rc0","3.11.0rc1","3.11.1","3.12.0","3.12.0rc0","3.13.0","3.13.0rc0","3.14.0","3.3.0","3.3.1","3.3.2","3.4.0","3.4.0rc0","3.5.0","3.5.0rc0","3.5.1","3.6.0","3.6.0rc0","3.7.0","3.7.0rc0","3.8.0","3.8.0rc0","3.8.1","3.9.0","3.9.0rc0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-7gwp-5pfp-969j/GHSA-7gwp-5pfp-969j.json"}}],"modified":"2026-10-02T18:30:39.856988982Z","provider":"osv","references":["https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j","https://nvd.nist.gov/vuln/detail/CVE-2026-64849","https://github.com/mlflow/mlflow/issues/24179","https://github.com/mlflow/mlflow/pull/24258","https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939","https://github.com/advisories/GHSA-7gwp-5pfp-969j","https://github.com/mlflow/mlflow","https://github.com/mlflow/mlflow/releases/tag/v3.15.0","https://github.com/pypa/advisory-database/tree/main/vulns/mlflow/PYSEC-2026-3687.yaml","https://pypi.org/project/mlflow","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-64849"],"provider_metadata":{"cwe_ids":["CWE-918"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2026-08-17T22:17:23Z","github_reviewed_at":"2026-08-17T21:58:51Z"}},"related_cves":[{"value":"CVE-2026-64849","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7gwp-5pfp-969j","priority":{"reasons":["publisher_severity","linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-64849","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":9.3,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"mlflow","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-64849","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"},{"cve":"CVE-2026-64849","metrics":[],"products":[{"name":{"value":"MLflow","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-64849","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7gwp-5pfp-969j","advisory_id":"5fe1fa61-7fc5-45f7-b11a-9586f3d40a1f","event_types":["advisory"],"published_at":"2026-10-25T22:45:50.32144+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-08-17T21:58:51+00:00","detail_url":"/events/71335"}]}},{"id":63874,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-qjwg-c74m-6hm8","summary":"MINI-qjwg-c74m-6hm8","evidence":"osv:MINI-qjwg-c74m-6hm8","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.2-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-qjwg-c74m-6hm8","aliases":["MINI-qjwg-c74m-6hm8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-qjwg-c74m-6hm8.json"}}],"modified":"2026-10-01T18:24:10.257935534Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ccc7d69f-eccd-4b11-9c38-356d26e6ad33","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-qjwg-c74m-6hm8","advisory_id":"ccc7d69f-eccd-4b11-9c38-356d26e6ad33","event_types":["advisory"],"published_at":"2026-10-25T19:39:19.882395+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/advisories/advisory%3Accc7d69f-eccd-4b11-9c38-356d26e6ad33","group":{"id":"advisory:ccc7d69f-eccd-4b11-9c38-356d26e6ad33","revision":1,"primary_event_id":63147,"change":"published","superseded_by":[],"changed":{"id":63147,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-qjwg-c74m-6hm8","summary":"MINI-qjwg-c74m-6hm8","evidence":"osv:MINI-qjwg-c74m-6hm8","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.2-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-qjwg-c74m-6hm8","aliases":["MINI-qjwg-c74m-6hm8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-qjwg-c74m-6hm8.json"}}],"modified":"2026-10-01T18:24:10.257935534Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ccc7d69f-eccd-4b11-9c38-356d26e6ad33","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-qjwg-c74m-6hm8","advisory_id":"ccc7d69f-eccd-4b11-9c38-356d26e6ad33","event_types":["advisory"],"published_at":"2026-10-25T19:39:19.882395+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/63147"},"members":[{"id":63147,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-qjwg-c74m-6hm8","summary":"MINI-qjwg-c74m-6hm8","evidence":"osv:MINI-qjwg-c74m-6hm8","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.2-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-qjwg-c74m-6hm8","aliases":["MINI-qjwg-c74m-6hm8"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-qjwg-c74m-6hm8.json"}}],"modified":"2026-10-01T18:24:10.257935534Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:ccc7d69f-eccd-4b11-9c38-356d26e6ad33","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-qjwg-c74m-6hm8","advisory_id":"ccc7d69f-eccd-4b11-9c38-356d26e6ad33","event_types":["advisory"],"published_at":"2026-10-25T19:39:19.882395+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/63147"}]}},{"id":63765,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-q357-qh57-xcg3","summary":"MINI-q357-qh57-xcg3","evidence":"osv:MINI-q357-qh57-xcg3","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-q357-qh57-xcg3","aliases":["MINI-q357-qh57-xcg3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-q357-qh57-xcg3.json"}}],"modified":"2026-10-01T18:24:01.297221018Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-q357-qh57-xcg3","advisory_id":"007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","event_types":["advisory"],"published_at":"2026-10-25T19:37:59.353215+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/advisories/advisory%3A007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","group":{"id":"advisory:007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","revision":1,"primary_event_id":63040,"change":"published","superseded_by":[],"changed":{"id":63040,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-q357-qh57-xcg3","summary":"MINI-q357-qh57-xcg3","evidence":"osv:MINI-q357-qh57-xcg3","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-q357-qh57-xcg3","aliases":["MINI-q357-qh57-xcg3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-q357-qh57-xcg3.json"}}],"modified":"2026-10-01T18:24:01.297221018Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-q357-qh57-xcg3","advisory_id":"007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","event_types":["advisory"],"published_at":"2026-10-25T19:37:59.353215+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/63040"},"members":[{"id":63040,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-q357-qh57-xcg3","summary":"MINI-q357-qh57-xcg3","evidence":"osv:MINI-q357-qh57-xcg3","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-q357-qh57-xcg3","aliases":["MINI-q357-qh57-xcg3"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-q357-qh57-xcg3.json"}}],"modified":"2026-10-01T18:24:01.297221018Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-q357-qh57-xcg3","advisory_id":"007a2906-1b00-4b71-ab3a-d8a5cf1f6db0","event_types":["advisory"],"published_at":"2026-10-25T19:37:59.353215+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/63040"}]}},{"id":63581,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-cw82-8687-5gm2","summary":"MINI-cw82-8687-5gm2","evidence":"osv:MINI-cw82-8687-5gm2","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-cw82-8687-5gm2","aliases":["MINI-cw82-8687-5gm2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-cw82-8687-5gm2.json"}}],"modified":"2026-10-01T18:23:44.070557437Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:18346702-f91f-4fe1-b5fe-44c6415b9f8e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-cw82-8687-5gm2","advisory_id":"18346702-f91f-4fe1-b5fe-44c6415b9f8e","event_types":["advisory"],"published_at":"2026-10-25T19:34:49.315876+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/advisories/advisory%3A18346702-f91f-4fe1-b5fe-44c6415b9f8e","group":{"id":"advisory:18346702-f91f-4fe1-b5fe-44c6415b9f8e","revision":1,"primary_event_id":62860,"change":"published","superseded_by":[],"changed":{"id":62860,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-cw82-8687-5gm2","summary":"MINI-cw82-8687-5gm2","evidence":"osv:MINI-cw82-8687-5gm2","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-cw82-8687-5gm2","aliases":["MINI-cw82-8687-5gm2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-cw82-8687-5gm2.json"}}],"modified":"2026-10-01T18:23:44.070557437Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:18346702-f91f-4fe1-b5fe-44c6415b9f8e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-cw82-8687-5gm2","advisory_id":"18346702-f91f-4fe1-b5fe-44c6415b9f8e","event_types":["advisory"],"published_at":"2026-10-25T19:34:49.315876+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62860"},"members":[{"id":62860,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-cw82-8687-5gm2","summary":"MINI-cw82-8687-5gm2","evidence":"osv:MINI-cw82-8687-5gm2","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-cw82-8687-5gm2","aliases":["MINI-cw82-8687-5gm2"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-cw82-8687-5gm2.json"}}],"modified":"2026-10-01T18:23:44.070557437Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:18346702-f91f-4fe1-b5fe-44c6415b9f8e","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-cw82-8687-5gm2","advisory_id":"18346702-f91f-4fe1-b5fe-44c6415b9f8e","event_types":["advisory"],"published_at":"2026-10-25T19:34:49.315876+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62860"}]}},{"id":63551,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-87hv-2c6x-r34m","summary":"MINI-87hv-2c6x-r34m","evidence":"osv:MINI-87hv-2c6x-r34m","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-87hv-2c6x-r34m","aliases":["MINI-87hv-2c6x-r34m"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-87hv-2c6x-r34m.json"}}],"modified":"2026-10-01T18:23:42.216503276Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b6b9c49-8497-4250-89f4-8afb079036fc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-87hv-2c6x-r34m","advisory_id":"1b6b9c49-8497-4250-89f4-8afb079036fc","event_types":["advisory"],"published_at":"2026-10-25T19:34:25.910899+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/advisories/advisory%3A1b6b9c49-8497-4250-89f4-8afb079036fc","group":{"id":"advisory:1b6b9c49-8497-4250-89f4-8afb079036fc","revision":1,"primary_event_id":62830,"change":"published","superseded_by":[],"changed":{"id":62830,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-87hv-2c6x-r34m","summary":"MINI-87hv-2c6x-r34m","evidence":"osv:MINI-87hv-2c6x-r34m","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-87hv-2c6x-r34m","aliases":["MINI-87hv-2c6x-r34m"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-87hv-2c6x-r34m.json"}}],"modified":"2026-10-01T18:23:42.216503276Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b6b9c49-8497-4250-89f4-8afb079036fc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-87hv-2c6x-r34m","advisory_id":"1b6b9c49-8497-4250-89f4-8afb079036fc","event_types":["advisory"],"published_at":"2026-10-25T19:34:25.910899+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62830"},"members":[{"id":62830,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-87hv-2c6x-r34m","summary":"MINI-87hv-2c6x-r34m","evidence":"osv:MINI-87hv-2c6x-r34m","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-87hv-2c6x-r34m","aliases":["MINI-87hv-2c6x-r34m"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-87hv-2c6x-r34m.json"}}],"modified":"2026-10-01T18:23:42.216503276Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1b6b9c49-8497-4250-89f4-8afb079036fc","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-87hv-2c6x-r34m","advisory_id":"1b6b9c49-8497-4250-89f4-8afb079036fc","event_types":["advisory"],"published_at":"2026-10-25T19:34:25.910899+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62830"}]}},{"id":63479,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-36cp-prvh-9228","summary":"MINI-36cp-prvh-9228","evidence":"osv:MINI-36cp-prvh-9228","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.2-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-36cp-prvh-9228","aliases":["MINI-36cp-prvh-9228"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-36cp-prvh-9228.json"}}],"modified":"2026-10-01T18:23:36.288385924Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f635bbbe-94f5-4ae4-b092-ef9eadb1832a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-36cp-prvh-9228","advisory_id":"f635bbbe-94f5-4ae4-b092-ef9eadb1832a","event_types":["advisory"],"published_at":"2026-10-25T19:33:32.857146+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/advisories/advisory%3Af635bbbe-94f5-4ae4-b092-ef9eadb1832a","group":{"id":"advisory:f635bbbe-94f5-4ae4-b092-ef9eadb1832a","revision":1,"primary_event_id":62760,"change":"published","superseded_by":[],"changed":{"id":62760,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-36cp-prvh-9228","summary":"MINI-36cp-prvh-9228","evidence":"osv:MINI-36cp-prvh-9228","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.2-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-36cp-prvh-9228","aliases":["MINI-36cp-prvh-9228"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-36cp-prvh-9228.json"}}],"modified":"2026-10-01T18:23:36.288385924Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f635bbbe-94f5-4ae4-b092-ef9eadb1832a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-36cp-prvh-9228","advisory_id":"f635bbbe-94f5-4ae4-b092-ef9eadb1832a","event_types":["advisory"],"published_at":"2026-10-25T19:33:32.857146+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62760"},"members":[{"id":62760,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-36cp-prvh-9228","summary":"MINI-36cp-prvh-9228","evidence":"osv:MINI-36cp-prvh-9228","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.15.2-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-36cp-prvh-9228","aliases":["MINI-36cp-prvh-9228"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.2-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-36cp-prvh-9228.json"}}],"modified":"2026-10-01T18:23:36.288385924Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:f635bbbe-94f5-4ae4-b092-ef9eadb1832a","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-36cp-prvh-9228","advisory_id":"f635bbbe-94f5-4ae4-b092-ef9eadb1832a","event_types":["advisory"],"published_at":"2026-10-25T19:33:32.857146+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62760"}]}},{"id":63408,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-5892-69p7-95cc","summary":"MINI-5892-69p7-95cc","evidence":"osv:MINI-5892-69p7-95cc","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-5892-69p7-95cc","aliases":["MINI-5892-69p7-95cc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-5892-69p7-95cc.json"}}],"modified":"2026-10-01T18:23:30.433003408Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:70166561-1e4d-49a8-9df1-d15cf7924b64","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-5892-69p7-95cc","advisory_id":"70166561-1e4d-49a8-9df1-d15cf7924b64","event_types":["advisory"],"published_at":"2026-10-25T19:31:48.985585+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/advisories/advisory%3A70166561-1e4d-49a8-9df1-d15cf7924b64","group":{"id":"advisory:70166561-1e4d-49a8-9df1-d15cf7924b64","revision":1,"primary_event_id":62695,"change":"published","superseded_by":[],"changed":{"id":62695,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-5892-69p7-95cc","summary":"MINI-5892-69p7-95cc","evidence":"osv:MINI-5892-69p7-95cc","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-5892-69p7-95cc","aliases":["MINI-5892-69p7-95cc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-5892-69p7-95cc.json"}}],"modified":"2026-10-01T18:23:30.433003408Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:70166561-1e4d-49a8-9df1-d15cf7924b64","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-5892-69p7-95cc","advisory_id":"70166561-1e4d-49a8-9df1-d15cf7924b64","event_types":["advisory"],"published_at":"2026-10-25T19:31:48.985585+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62695"},"members":[{"id":62695,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-5892-69p7-95cc","summary":"MINI-5892-69p7-95cc","evidence":"osv:MINI-5892-69p7-95cc","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.16.1-r0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-5892-69p7-95cc","aliases":["MINI-5892-69p7-95cc"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-r0"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-5892-69p7-95cc.json"}}],"modified":"2026-10-01T18:23:30.433003408Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:70166561-1e4d-49a8-9df1-d15cf7924b64","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-5892-69p7-95cc","advisory_id":"70166561-1e4d-49a8-9df1-d15cf7924b64","event_types":["advisory"],"published_at":"2026-10-25T19:31:48.985585+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T14:11:42+00:00","detail_url":"/events/62695"}]}},{"id":17832,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-rmw9-qfjg-924m","summary":"MINI-rmw9-qfjg-924m","evidence":"osv:MINI-rmw9-qfjg-924m","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-rmw9-qfjg-924m","aliases":["MINI-rmw9-qfjg-924m"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-r1"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rmw9-qfjg-924m.json"}}],"modified":"2026-09-25T18:23:31.162210477Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d69021b4-55a9-4ed5-af8a-8d252dcd9668","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-rmw9-qfjg-924m","advisory_id":"d69021b4-55a9-4ed5-af8a-8d252dcd9668","event_types":["advisory"],"published_at":"2026-10-25T01:39:39.921998+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:00:40+00:00","detail_url":"/advisories/advisory%3Ad69021b4-55a9-4ed5-af8a-8d252dcd9668","group":{"id":"advisory:d69021b4-55a9-4ed5-af8a-8d252dcd9668","revision":1,"primary_event_id":17712,"change":"published","superseded_by":[],"changed":{"id":17712,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-rmw9-qfjg-924m","summary":"MINI-rmw9-qfjg-924m","evidence":"osv:MINI-rmw9-qfjg-924m","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-rmw9-qfjg-924m","aliases":["MINI-rmw9-qfjg-924m"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-r1"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rmw9-qfjg-924m.json"}}],"modified":"2026-09-25T18:23:31.162210477Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d69021b4-55a9-4ed5-af8a-8d252dcd9668","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-rmw9-qfjg-924m","advisory_id":"d69021b4-55a9-4ed5-af8a-8d252dcd9668","event_types":["advisory"],"published_at":"2026-10-25T01:39:39.921998+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:00:40+00:00","detail_url":"/events/17712"},"members":[{"id":17712,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-rmw9-qfjg-924m","summary":"MINI-rmw9-qfjg-924m","evidence":"osv:MINI-rmw9-qfjg-924m","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-rmw9-qfjg-924m","aliases":["MINI-rmw9-qfjg-924m"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-r1"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-rmw9-qfjg-924m.json"}}],"modified":"2026-09-25T18:23:31.162210477Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:d69021b4-55a9-4ed5-af8a-8d252dcd9668","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-rmw9-qfjg-924m","advisory_id":"d69021b4-55a9-4ed5-af8a-8d252dcd9668","event_types":["advisory"],"published_at":"2026-10-25T01:39:39.921998+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:00:40+00:00","detail_url":"/events/17712"}]}},{"id":17749,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-7f3w-c659-vphx","summary":"MINI-7f3w-c659-vphx","evidence":"osv:MINI-7f3w-c659-vphx","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-7f3w-c659-vphx","aliases":["MINI-7f3w-c659-vphx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-r1"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-7f3w-c659-vphx.json"}}],"modified":"2026-09-25T18:23:24.943765620Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5a52aacf-d03a-4fa3-8765-3535c1fd337d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-7f3w-c659-vphx","advisory_id":"5a52aacf-d03a-4fa3-8765-3535c1fd337d","event_types":["advisory"],"published_at":"2026-10-25T01:38:06.184551+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:00:40+00:00","detail_url":"/advisories/advisory%3A5a52aacf-d03a-4fa3-8765-3535c1fd337d","group":{"id":"advisory:5a52aacf-d03a-4fa3-8765-3535c1fd337d","revision":1,"primary_event_id":17630,"change":"published","superseded_by":[],"changed":{"id":17630,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-7f3w-c659-vphx","summary":"MINI-7f3w-c659-vphx","evidence":"osv:MINI-7f3w-c659-vphx","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-7f3w-c659-vphx","aliases":["MINI-7f3w-c659-vphx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-r1"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-7f3w-c659-vphx.json"}}],"modified":"2026-09-25T18:23:24.943765620Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5a52aacf-d03a-4fa3-8765-3535c1fd337d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-7f3w-c659-vphx","advisory_id":"5a52aacf-d03a-4fa3-8765-3535c1fd337d","event_types":["advisory"],"published_at":"2026-10-25T01:38:06.184551+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:00:40+00:00","detail_url":"/events/17630"},"members":[{"id":17630,"cve_ids":[],"payload":{"kind":"advisory","title":"MINI-7f3w-c659-vphx","summary":"MINI-7f3w-c659-vphx","evidence":"osv:MINI-7f3w-c659-vphx","products":[{"name":{"value":"mlflow","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"3.14.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"MINI-7f3w-c659-vphx","aliases":["MINI-7f3w-c659-vphx"],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.0-r1"}]}],"package":{"name":"mlflow","purl":"pkg:apk/minimos/mlflow","ecosystem":"MinimOS"},"database_specific":{"source":"https://packages.mini.dev/advisories/osv/MINI-7f3w-c659-vphx.json"}}],"modified":"2026-09-25T18:23:24.943765620Z","provider":"osv","references":[]},"related_cves":[],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5a52aacf-d03a-4fa3-8765-3535c1fd337d","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/MINI-7f3w-c659-vphx","advisory_id":"5a52aacf-d03a-4fa3-8765-3535c1fd337d","event_types":["advisory"],"published_at":"2026-10-25T01:38:06.184551+00:00","technologies":["core-osv","mlflow"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T15:00:40+00:00","detail_url":"/events/17630"}]}}],"next_after":70964,"next_before":17749}