CVE-2026-96775
MLflow dspy bypasses pickle deserialization control
CVSS score
8.8
EPSS probability
%0.4
Risk score
0.0
Published
22 d ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
9.3
CVE-2026-64849 Actively exploited
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
M
Patch verified Public Exploits:1EPSS %10
9.1
CVE-2026-0545
Missing Authentication for Critical Function in mlflow/mlflow
M
Patch status unknown Public Exploits:1EPSS %4
7.5
CVE-2026-2614
Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
M
Patch verified Public Exploits:1EPSS %3
9.1
CVE-2026-4035
Environment Variable Resolution Vulnerability in mlflow/mlflow
M
Patch verifiedEPSS %1
8.8
CVE-2026-96804
CVE-2026-96804
M
Patch status unknownEPSS %0
7.1
CVE-2026-69148
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
M
Patch verifiedEPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-96775"