CVE-2026-10803

Summary

A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is

Severity

medium

EPSS

0.1% (p1)

Also known as

BIT-mlflow-2026-10803, PYSEC-2026-195

Published

2026-06-04

References

• https://github.com/mlflow/mlflow/
• https://vuldb.com/cve/CVE-2026-10803
• https://vuldb.com/submit/831462

Related advisories

• CVE-2026-64849 — critical · PyPI/mlflow
• CVE-2026-2611 — critical · PyPI/mlflow
• CVE-2026-0545 — critical · PyPI/mlflow
• CVE-2026-0596 — critical · PyPI/mlflow
• CVE-2025-15379 — critical · PyPI/mlflow
• CVE-2025-15036 — critical · PyPI/mlflow
• CVE-2026-2635 — critical · PyPI/mlflow
• GHSA-gqvg-gmmx-x4hm — high · PyPI/mlflow

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity