MLflowGHSA-wqxf-447m-6f5f
Information exposure in MLflow
High7.5CVE-2023-43472 · Published Dec 5, 2023 · updated Jul 7, 2026
An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| mlflow PyPI | < 2.9.0 | 2.9.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-mlflow-2023-43472, CVE-2023-43472, PYSEC-2026-1661
More MLflow advisories
All MLflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 202023 | MLflow Path Traversal Vulnerability High8.8Dec 20, 2023 | High8.8 | 2.9.2 |
| Dec 192023 | mlflow Command Injection vulnerabilityHigh8.8Dec 19, 2023 | High8.8 | 2.9.2 |
| Dec 152023 | Path traversal in MLflowCritical10.0Dec 15, 2023 | Critical10.0 | 2.9.2 |
| Dec 132023 | Path traversal in MLflowHigh8.8Dec 13, 2023 | High8.8 | 2.9.2 |
| Dec 122023 | Jinja2 template injection in mlflowHigh8.8Dec 12, 2023 | High8.8 | 2.9.2 |
| Dec 72023 | Cross-site Scripting (XSS) in MLflowMedium6.5Dec 7, 2023 | Medium6.5 | 2.9.0 |