Security Report - eizen-mlflow-service

🔴 Vulnerabilities (2)
Severity	CVE ID	Package	Installed	Fixed In	Description
MEDIUM	CVE-2026-39892	cryptography	46.0.6	46.0.7	cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
MEDIUM	CVE-2026-33865	mlflow	3.11.0	3.11.1	MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLm
🔑 Secrets (0)
Type	File	Line	Match
✅ No secrets found
⚙️ Misconfigurations (1)
Severity	ID	Check	File	Message
HIGH	DS002	Image user should not be 'root'	Dockerfile	Specify at least 1 USER command in Dockerfile with non-root user as argument
📄 Raw JSON Report (click to expand)
{
  "SchemaVersion": 2,
  "CreatedAt": "2026-05-05T07:50:43.576160968Z",
  "ArtifactName": "/src",
  "ArtifactType": "filesystem",
  "Metadata": {
    "ImageConfig": {
      "architecture": "",
      "created": "0001-01-01T00:00:00Z",
      "os": "",
      "rootfs": {
        "type": "",
        "diff_ids": null
      },
      "config": {}
    }
  },
  "Results": [
    {
      "Target": "requirements.txt",
      "Class": "lang-pkgs",
      "Type": "pip",
      "Vulnerabilities": [
        {
          "VulnerabilityID": "CVE-2026-39892",
          "PkgName": "cryptography",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/cryptography@46.0.6"
          },
          "InstalledVersion": "46.0.6",
          "FixedVersion": "46.0.7",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-39892",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API",
          "Description": "cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-119"
          ],
          "VendorSeverity": {
            "ghsa": 2,
            "nvd": 4,
            "redhat": 2
          },
          "CVSS": {
            "ghsa": {},
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "V3Score": 9.8
            },
            "redhat": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
              "V3Score": 5.3
            }
          },
          "References": [
            "http://www.openwall.com/lists/oss-security/2026/04/08/12",
            "https://access.redhat.com/security/cve/CVE-2026-39892",
            "https://github.com/pyca/cryptography",
            "https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5",
            "https://github.com/pyca/cryptography/security/advisories/GHSA-p423-j2cm-9vmq",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-39892",
            "https://www.cve.org/CVERecord?id=CVE-2026-39892"
          ],
          "PublishedDate": "2026-04-08T21:17:01.547Z",
          "LastModifiedDate": "2026-04-15T16:12:39.677Z"
        },
        {
          "VulnerabilityID": "CVE-2026-33865",
          "PkgName": "mlflow",
          "PkgIdentifier": {
            "PURL": "pkg:pypi/mlflow@3.11.0"
          },
          "InstalledVersion": "3.11.0",
          "FixedVersion": "3.11.1",
          "Status": "fixed",
          "Layer": {},
          "SeveritySource": "ghsa",
          "PrimaryURL": "https://avd.aquasec.com/nvd/cve-2026-33865",
          "DataSource": {
            "ID": "ghsa",
            "Name": "GitHub Security Advisory pip",
            "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Apip"
          },
          "Title": "MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface",
          "Description": "MLflow is vulnerable to Stored Cross-Site Scripting (XSS) caused by unsafe parsing of YAML-based MLmodel artifacts in its web interface. An authenticated attacker can upload a malicious MLmodel file containing a payload that executes when another user views the artifact in the UI. This allows actions such as session hijacking or performing operations on behalf of the victim. \n\nThis issue affects MLflow version through 3.10.1",
          "Severity": "MEDIUM",
          "CweIDs": [
            "CWE-79"
          ],
          "VendorSeverity": {
            "bitnami": 2,
            "ghsa": 2,
            "nvd": 2
          },
          "CVSS": {
            "bitnami": {},
            "ghsa": {},
            "nvd": {
              "V3Vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "V3Score": 5.4
            }
          },
          "References": [
            "https://afine.com/blogs/attacking-mlflow-how-ml-artifacts-become-attack-vectors",
            "https://cert.pl/en/posts/2026/04/CVE-2026-33865",
            "https://cert.pl/en/posts/2026/04/CVE-2026-33865/",
            "https://github.com/mlflow/mlflow",
            "https://github.com/mlflow/mlflow/commit/aca4dd0ec88a12f7655155c224371280e9b45dda",
            "https://github.com/mlflow/mlflow/pull/21435",
            "https://nvd.nist.gov/vuln/detail/CVE-2026-33865"
          ],
          "PublishedDate": "2026-04-07T13:16:46.84Z",
          "LastModifiedDate": "2026-04-20T18:44:12.623Z"
        }
      ]
    },
    {
      "Target": "Dockerfile",
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
        "Successes": 23,
        "Failures": 1,
        "Exceptions": 0
      },
      "Misconfigurations": [
        {
          "Type": "Dockerfile Security Check",
          "ID": "DS002",
          "AVDID": "AVD-DS-0002",
          "Title": "Image user should not be 'root'",
          "Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
          "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
          "Namespace": "builtin.dockerfile.DS002",
          "Query": "data.builtin.dockerfile.DS002.deny",
          "Resolution": "Add 'USER <non root user name>' line to the Dockerfile",
          "Severity": "HIGH",
          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds002",
          "References": [
            "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
            "https://avd.aquasec.com/misconfig/ds002"
          ],
          "Status": "FAIL",
          "Layer": {},
          "CauseMetadata": {
            "Provider": "Dockerfile",
            "Service": "general",
            "Code": {
              "Lines": null
            }
          }
        }
      ]
    }
  ]
}
🛡️ Security Scan Report

0

1

2

0

0

1
