MLflowGHSA-qg8p-32gr-gh6x

MLflow Local File Disclosure Vulnerability

High7.5CVE-2023-6977 · Published Dec 20, 2023 · updated Jul 7, 2026

This vulnerability enables malicious users to read sensitive files on the server.

GitHub advisory

Affected versions

Package	Affected	Fixed in
mlflow PyPI	< 2.9.2	2.9.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: GitHub (reviewed advisory)
Weakness: CWE-29
Also known as: BIT-mlflow-2023-6977, CVE-2023-6977, PYSEC-2026-1659

More MLflow advisories

Date	Advisory	Severity	Fixed in
Dec 202023	MLflow Server-Side Request Forgery (SSRF) Critical9.8Dec 20, 2023 CVE-2023-69742.9.2	Critical9.8	2.9.2
Dec 202023	MLflow Path Traversal Vulnerability High7.5Dec 20, 2023 CVE-2023-69092.9.2	High7.5	2.9.2
Dec 202023	MLFlow Path Traversal Vulnerability Critical9.8Dec 20, 2023 CVE-2023-69752.9.2	Critical9.8	2.9.2
Dec 202023	MLflow Path Traversal Vulnerability High8.8Dec 20, 2023 CVE-2023-69762.9.2	High8.8	2.9.2
Dec 192023	mlflow Command Injection vulnerability High8.8Dec 19, 2023 CVE-2023-69402.9.2	High8.8	2.9.2
Dec 152023	Path traversal in MLflow Critical10.0Dec 15, 2023 CVE-2023-68312.9.2	Critical10.0	2.9.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.