4 min read
News Brief Three MLflow CVEs published on October 27 cover code execution on servers without authentication through third-party scorers, arbitrary file read via prompt model versions, and LLM provider API key leakage from CrewAI traces. All are fixed in MLflow 3.17.0.