10.0
Critical
CVE-2023-6018 An attacker can overwrite any file on the server hosting MLflow without any authentication
Description
An attacker can overwrite any file on the server hosting MLflow without any authentication.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| mlflow/mlflow | Versions not published |
References
- huntr.com huntr.com
Timeline
- Published
- Last modified
Other CVEs of mlflow/mlflow
The 55 CVEs of mlflow/mlflow →
CVE-2026-8147
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper…
8.1
High
CVE-2026-4035
A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI…
9.1
Critical
CVE-2026-3198
MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API…
6.5
Medium
CVE-2026-2651
A vulnerability in MLflow…
9.0
Critical