6 CVEs matched to Databricks by name in NVD, none on CISA's Known Exploited list.
Back to the Databricks profile · Alternatives to Databricks · CVE RSS feed
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulner…
Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the …
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databric…
| Year | Critical | High | Medium | Low | Unscored | Total |
|---|---|---|---|---|---|---|
| 2026 | 1 | 1 | 1 | 0 | 0 | 3 |
| 2025 | 1 | 0 | 0 | 0 | 1 | 2 |
| 2024 | 0 | 1 | 0 | 0 | 0 | 1 |
EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.
| CVE | EPSS | Percentile |
|---|---|---|
| CVE-2026-33107 | 0.9% | 59% |
| CVE-2024-49194 | 0.7% | 52% |
| CVE-2025-53763 | 0.7% | 51% |
| CVE-2026-32794 | 0.4% | 36% |
| CVE-2025-41116 | 0.3% | 20% |
| CVE-2026-4137 | 0.2% | 5.0% |
In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_c…
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
Improper Certificate Validation vulnerability in Apache Airflow Provider for Databricks. Provider code did not validate certificates for connections to Databricks back-end which could result in a man-…
When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, …
Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handli…