Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · MLflow

CVE-2023-6974: MLflow Server-Side Request Forgery (SSRF)

criticalCVSS 3.1 9.8GHSA-59v3-898r-qwhj

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abused to get a remote code execution on the victim machine.

Published Dec 20, 2023 · Updated Jan 2, 2024

Affected packages

mlflow

Ecosystem
PyPI
Affected
< 2.9.2
Fixed in
2.9.2
Check
pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abused to get a remote code execution on the victim machine.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries