Skip to content

Commit 9c9cccc

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-gq3w-7jj3-x7gr GHSA-q2r8-vmq7-fpx2 GHSA-34g8-9fpp-46ch GHSA-3rhr-jr63-hwq5 GHSA-679f-wmrg-qf57 GHSA-fx49-m253-27jj GHSA-gq3w-7jj3-x7gr GHSA-34g8-9fpp-46ch GHSA-3rhr-jr63-hwq5 GHSA-679f-wmrg-qf57 GHSA-fx49-m253-27jj
1 parent e1275fe commit 9c9cccc

11 files changed

Lines changed: 675 additions & 189 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-gq3w-7jj3-x7gr/GHSA-gq3w-7jj3-x7gr.json‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-gq3w-7jj3-x7gr",
4+
"modified": "2026-03-17T20:02:55Z",
5+
"published": "2026-02-21T00:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2635"
8+
],
9+
"summary": "MLflow Use of Default Password Authentication Bypass Vulnerability",
10+
"details": "This vulnerability allows remote attackers to bypass authentication on affected installations of MLflow. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the basic_auth.ini file. The file contains hard-coded default credentials. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of the administrator.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "mlflow"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.8.0rc0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "ADVISORY",
41+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2635"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/mlflow/mlflow/pull/19260"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/mlflow/mlflow"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0"
58+
},
59+
{
60+
"type": "WEB",
61+
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-111"
62+
}
63+
],
64+
"database_specific": {
65+
"cwe_ids": [
66+
"CWE-1393"
67+
],
68+
"severity": "CRITICAL",
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-03-17T20:02:55Z",
71+
"nvd_published_at": "2026-02-20T23:16:05Z"
72+
}
73+
}

advisories/unreviewed/2026/02/GHSA-q2r8-vmq7-fpx2/GHSA-q2r8-vmq7-fpx2.json renamed to advisories/github-reviewed/2026/02/GHSA-q2r8-vmq7-fpx2/GHSA-q2r8-vmq7-fpx2.json

Lines changed: 38 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-q2r8-vmq7-fpx2",
4-
"modified": "2026-02-21T00:31:43Z",
4+
"modified": "2026-03-17T20:03:07Z",
55
"published": "2026-02-21T00:31:43Z",
66
"aliases": [
77
"CVE-2026-2033"
88
],
9-
"details": "MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26649.",
9+
"summary": "MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability",
10+
"details": "MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.\n\nThe specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "mlflow"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "3.8.0rc0"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -23,6 +44,18 @@
2344
"type": "WEB",
2445
"url": "https://github.com/mlflow/mlflow/pull/19260"
2546
},
47+
{
48+
"type": "WEB",
49+
"url": "https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/mlflow/mlflow"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0"
58+
},
2659
{
2760
"type": "WEB",
2861
"url": "https://www.zerodayinitiative.com/advisories/ZDI-26-105"
@@ -33,8 +66,8 @@
3366
"CWE-22"
3467
],
3568
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
69+
"github_reviewed": true,
70+
"github_reviewed_at": "2026-03-17T20:03:07Z",
3871
"nvd_published_at": "2026-02-20T23:16:03Z"
3972
}
4073
}

‎advisories/github-reviewed/2026/03/GHSA-34g8-9fpp-46ch/GHSA-34g8-9fpp-46ch.json‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-34g8-9fpp-46ch",
4+
"modified": "2026-03-17T20:01:22Z",
5+
"published": "2026-03-16T15:30:43Z",
6+
"aliases": [
7+
"CVE-2026-2456"
8+
],
9+
"summary": "Mattermost fails to limit the size of responses from integration action endpoints",
10+
"details": "Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 Mattermost fails to limit the size of responses from integration action endpoints, which allows an authenticated attacker to cause server memory exhaustion and denial of service via a malicious integration server that returns an arbitrarily large response when a user clicks an interactive message button. Mattermost Advisory ID: MMSA-2026-00571",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/mattermost/mattermost/server/v8"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "8.0.0-20260127165411-fe3052073dc6"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/mattermost/mattermost-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "5.3.2-0.20260127165411-fe3052073dc6"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Go",
59+
"name": "github.com/mattermost/mattermost-server"
60+
},
61+
"ranges": [
62+
{
63+
"type": "ECOSYSTEM",
64+
"events": [
65+
{
66+
"introduced": "10.11.0-rc1"
67+
},
68+
{
69+
"fixed": "10.11.11"
70+
}
71+
]
72+
}
73+
]
74+
},
75+
{
76+
"package": {
77+
"ecosystem": "Go",
78+
"name": "github.com/mattermost/mattermost-server"
79+
},
80+
"ranges": [
81+
{
82+
"type": "ECOSYSTEM",
83+
"events": [
84+
{
85+
"introduced": "11.2.0-rc1"
86+
},
87+
{
88+
"fixed": "11.2.3"
89+
}
90+
]
91+
}
92+
]
93+
},
94+
{
95+
"package": {
96+
"ecosystem": "Go",
97+
"name": "github.com/mattermost/mattermost-server"
98+
},
99+
"ranges": [
100+
{
101+
"type": "ECOSYSTEM",
102+
"events": [
103+
{
104+
"introduced": "11.3.0-rc1"
105+
},
106+
{
107+
"fixed": "11.3.1"
108+
}
109+
]
110+
}
111+
]
112+
}
113+
],
114+
"references": [
115+
{
116+
"type": "ADVISORY",
117+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2456"
118+
},
119+
{
120+
"type": "WEB",
121+
"url": "https://github.com/mattermost/mattermost/commit/fe3052073dc67e3c920baf9fe7efd44ac1d8124c"
122+
},
123+
{
124+
"type": "PACKAGE",
125+
"url": "https://github.com/mattermost/mattermost"
126+
},
127+
{
128+
"type": "WEB",
129+
"url": "https://mattermost.com/security-updates"
130+
}
131+
],
132+
"database_specific": {
133+
"cwe_ids": [
134+
"CWE-789"
135+
],
136+
"severity": "MODERATE",
137+
"github_reviewed": true,
138+
"github_reviewed_at": "2026-03-17T20:01:22Z",
139+
"nvd_published_at": "2026-03-16T14:19:29Z"
140+
}
141+
}

0 commit comments

Comments
 (0)