GHSA-4qq5-mxxx-m6gg BIT-mlflow-2023-6014 CVE-2023-6014 PYSEC-2026-415
MLflow authentication requirement bypass can allow a user to arbitrarily create an account
- Severity
- 9.1 / 10
- Critical · CVSS 3.0
- Exploit chance (EPSS)
- 1.17%
- Chance of exploitation in the next 30 days. Higher than 67.35% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-598 Use of HTTP Request With Sensitive Query String
- Fix
2.8.0- Upgrade mlflow to this version or later
Description
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| mlflow | < 2.8.0 |
2.8.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mlflow PyPI → 2.8.0
- pip
pip install --upgrade "mlflow>=2.8.0"- poetry
poetry add "mlflow>=2.8.0"- uv
uv add "mlflow>=2.8.0"
Severity breakdown
CVSS 3.0 9.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Weakness
CWE-598: Use of HTTP Request With Sensitive Query String
The web application uses an HTTP method to process a request, but the request includes sensitive information in the query string.
How to prevent it
- Implementation: When sending sensitive information, only include it in the request body or request headers instead of the query string. This may require avoiding use of GET requests.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-7gwp-5pfp-969j MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | Critical Known exploited | Also affects mlflow |
| GHSA-26p8-2jq9-3vq9 MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules | Critical | Also affects mlflow |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Also affects mlflow |
| GHSA-m65p-9j7q-6w33 MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source | High | Also affects mlflow |
| GHSA-2wqp-q3c6-ccj5 MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints | Medium | Also affects mlflow |
| GHSA-wqmh-qccw-pqwf MLflow FileStore trace IDs allow path traversal and arbitrary file writes | High | Also affects mlflow |
| GHSA-gqvg-gmmx-x4hm MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact | High | Also affects mlflow |
| GHSA-h7x2-h6g9-p789 MLflow AI Gateway permits SSRF through an unvalidated api_base | High | Also affects mlflow |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor