Mlflow - Mlflow/mlflow - HIGH - CVE-2025-14279. MLFlow versions up to 3.4.0 are susceptible to DNS rebinding attacks due to insufficient validation of the Origin header in its REST server. This weakness allows malicious websites to circumvent Same-Origin Policy protections, enabling unauthorized interactions with REST endpoints. Attackers can exploit this vulnerability to query, update, or delete experiments within MLFlow, posing risks of data exfiltration, loss, or alteration. The issue has been addressed in version 3.5.0.