DNS Rebinding Vulnerability in MLFlow by Databricks
CVE-2025-14279

8.1HIGH

Key Information:

Vendor

Mlflow

Status
Mlflow/mlflow
Vendor
CVE Published:
12 January 2026

What is CVE-2025-14279?

MLFlow versions up to 3.4.0 are susceptible to DNS rebinding attacks due to insufficient validation of the Origin header in its REST server. This weakness allows malicious websites to circumvent Same-Origin Policy protections, enabling unauthorized interactions with REST endpoints. Attackers can exploit this vulnerability to query, update, or delete experiments within MLFlow, posing risks of data exfiltration, loss, or alteration. The issue has been addressed in version 3.5.0.

Affected Version(s)

mlflow/mlflow < 3.5.0

References

https://huntr.com/bounties/ef478f72-2e4f-44dc-8055-fc06be...
https://github.com/mlflow/mlflow/commit/b0ffd289e9b0d0cc3...

CVSS V3.0

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.