MLflowGHSA-4qq5-mxxx-m6gg
MLflow authentication requirement bypass can allow a user to arbitrarily create an account
Critical9.1CVE-2023-6014 · Published Nov 16, 2023 · updated Jun 29, 2026
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirement.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.8.0 | 2.8.0 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-598
- Also known as
- BIT-mlflow-2023-6014, CVE-2023-6014, PYSEC-2026-415
- nvd.nist.gov/vuln/detail/CVE-2023-6014
- github.com/mlflow/mlflow/issues/9669
- github.com/mlflow/mlflow/pull/9700
- github.com/mlflow/mlflow/commit/32de2154ef9f946160e5dc01a4d8a449dd0bd259
- github.com/mlflow/mlflow
- github.com/mlflow/mlflow/releases/tag/v2.8.0
- huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 132023 | Path traversal in MLflow High8.8Dec 13, 2023 | High8.8 | 2.9.2 |
| Dec 122023 | Jinja2 template injection in mlflowHigh8.8Dec 12, 2023 | High8.8 | 2.9.2 |
| Dec 72023 | Cross-site Scripting (XSS) in MLflowMedium6.5Dec 7, 2023 | Medium6.5 | 2.9.0 |
| Dec 52023 | Information exposure in MLflowHigh7.5Dec 5, 2023 | High7.5 | 2.9.0 |
| Nov 162023 | Remote Code Execution due to Full Controled File Write in mlflowCritical10.0Nov 16, 2023 | Critical10.0 | 2.9.2 |
| Nov 162023 | MLflow allowed arbitrary files to be PUT onto the serverCritical10.0Nov 16, 2023 | Critical10.0 | 2.8.1 |