AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

MLflowGHSA-wqxf-447m-6f5f

Information exposure in MLflow

MLflow

CVE-2023-43472 · Published Dec 5, 2023 · updated Jul 7, 2026

High7.5
Fix: upgrade to 2.9.0 or later
GitHub advisory

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.

Affected versions

PackageAffectedFixed in
mlflow
PyPI
< 2.9.02.9.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200
Also known as
BIT-mlflow-2023-43472, CVE-2023-43472, PYSEC-2026-1661

More MLflow advisories

All MLflow
High 8.8Dec 20, 2023MLflow Path Traversal VulnerabilityCVE-2023-6976fixed in 2.9.2High 8.8Dec 19, 2023mlflow Command Injection vulnerabilityCVE-2023-6940fixed in 2.9.2Critical 10.0Dec 15, 2023Path traversal in MLflowCVE-2023-6831fixed in 2.9.2High 8.8Dec 13, 2023Path traversal in MLflowCVE-2023-6753fixed in 2.9.2High 8.8Dec 12, 2023Jinja2 template injection in mlflowCVE-2023-6709fixed in 2.9.2Medium 6.5Dec 7, 2023Cross-site Scripting (XSS) in MLflowCVE-2023-6568fixed in 2.9.0