MLflowPublished 20 Dec 2023NVD status: Modified

CVE-2023-6976

MLflow: This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

ComponentMLflow
Severityhigh (CVSS 8.8)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published (NVD)2023-12-20
Last modified2026-06-17
Affected versions
< 2.9.2
Fixed in2.9.2
WeaknessCWE-434
CISA KEVnot listed

NVD description

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

What to do

  • Upgrade MLflow to 2.9.2 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more