MLflowGHSA-qpgc-w4mg-6v92
MLflow's excessive directory permissions allow local privilege escalation
High7.0CVE-2024-27134 · Published Nov 25, 2024 · updated Feb 3, 2025
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.16.0 | 2.16.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-276
- Also known as
- BIT-mlflow-2024-27134, CVE-2024-27134, PYSEC-2024-224
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | MLflow Cross-Site Request Forgery (CSRF) vulnerability Medium5.4Mar 20, 2025 | Medium5.4 | 2.20.3 |
| Mar 202025 | MLflow has Weak Password RequirementsLow3.8Mar 20, 2025 | Low3.8 | 2.19.0 |
| Mar 202025 | MLflow Uncontrolled Resource Consumption vulnerabilityMedium5.9Mar 20, 2025 | Medium5.9 | No fix yet |
| Mar 202025 | MLflow has a Local File Read/Path Traversal in dbfsHigh7.5Mar 20, 2025 | High7.5 | 2.17.0rc0 |
| Mar 202025 | MLflow Uncontrolled Resource Consumption vulnerabilityMedium5.3Mar 20, 2025 | Medium5.3 | No fix yet |
| Jun 62024 | Undefined Behavior in mlflowMedium5.4Jun 6, 2024 | Medium5.4 | 2.11.3 |