CVE-2023-6018: Remote Code Execution in mlflow
Summary
CVE-2023-6018: Remote Code Execution due to Full Controled File Write in mlflow. Affects mlflow versions < 2.9.2. Fixed in 2.9.2. How to fix ↓
Also tracked for
- mlflow · Bitnami
The same CVE-2023-6018 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mlflow is an open-source platform for managing and tracking machine learning experiments. It provides tools for experiment tracking, packaging code into reproducible runs, and sharing and deploying models. mlflow includes a web server component that allows users to interact with the platform through a web interface. This vulnerability in mlflow allows an attacker to write or overwrite any file on the file system, potentially leading to remote code execution. By exploiting this issue, a malicious user can gain command execution on the vulnerable machine and access data and model information.
Vulnerability Detail
The vulnerability in mlflow arises from a lack of proper file write validation in the web server component. This allows an attacker to craft requests that write arbitrary files to the file system. By overwriting critical files, such as the user's .bashrc file, an attacker can execute arbitrary commands on the vulnerable machine. This can lead to unauthorized access, data exfiltration, and further compromise of the system. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 10.0.
How To Fix
Latest published version: 3.17.2 as of 23 Oct 2026
pip install --upgrade "mlflow==3.17.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9.2
This is the first release that contains the fix.
pip install --upgrade "mlflow==2.9.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the mlflow web server to trusted networks or IP addresses. This can be achieved by configuring firewall rules or network access control lists (ACLs) to only allow connections from trusted sources. By limiting access to the vulnerable component, the risk of exploitation can be reduced.
Conclusion
The vulnerability in mlflow allows for remote code execution by exploiting a file write validation issue in the web server component. To mitigate the risk, it is crucial to update mlflow to version 2.8.2 or later. Restricting access to the vulnerable component can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mlflow →
FAQ
mlflow is an open-source platform for managing and tracking machine learning experiments. It provides tools for experiment tracking, packaging code into reproducible runs, and sharing and deploying models.
This vulnerability allows an attacker to write or overwrite any file on the file system, potentially leading to remote code execution. By exploiting this issue, a malicious user can gain command execution on the vulnerable machine and access data and model information.
To fix this vulnerability, it is recommended to upgrade mlflow to version 2.8.2 or later. The latest version includes a patch that addresses the file write validation issue.
As a temporary workaround, users can restrict access to the mlflow web server to trusted networks or IP addresses. This can be achieved by configuring firewall rules or network access control lists (ACLs) to only allow connections from trusted sources.
This vulnerability is rated as CRITICAL with a CVSS score of 10.0, indicating its high severity and potential impact.
Related vulnerabilities
Recent vulnerabilities recorded for mlflow.
