CVE-2026-10803

Katalog CVE

CVSS 3.6 · Low EPSS 0,10%

Kerentanan Use of a Broken or Risky Cryptographic Algorithm pada lfprojects mlflow. Skor CVSS 3.1 3.6 (Low) menurut vuldb.com.

Deskripsi (NVD)

A flaw has been found in MLflow up to 3.10.0. This issue affects the function mlflow.data.digest_utils of the file mlflow/data/digest_utils.py of the component Dataset Digest Computation. This manipulation causes use of weak hash. It is possible to launch the attack on the local host. The attack is considered to have high complexity. The exploitability is assessed as difficult. The exploit has been published and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

Rincian

Terbit di NVD

4 Juni 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

3.6 (Low), sumber vuldb.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CWE-328: Use of Weak Hash

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mlflow/mlflow/issues/22419 exploit · issue tracking · mitigasi
• https://vuldb.com/cve/CVE-2026-10803 advisory pihak ketiga · vdb entry
• https://vuldb.com/submit/831462 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/368252 advisory pihak ketiga · vdb entry
• https://github.com/mlflow/mlflow/ product
• https://github.com/mlflow/mlflow/pull/22420 issue tracking
• https://vuldb.com/vuln/368252/cti permissions required · vdb entry