Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · MLflow

CVE-2024-27134: MLflow's excessive directory permissions allow local privilege escalation

highCVSS 4.0 7.3 · 3.1 7.0GHSA-qpgc-w4mg-6v92

Excessive directory permissions in MLflow leads to local privilege escalation when using sparkudf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the sparkudf() MLflow API is called.

Published Nov 25, 2024

Affected packages

mlflow

Ecosystem
PyPI
Affected
< 2.16.0
Fixed in
2.16.0
Check
pip show mlflow

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More MLflow vulnerabilities

All MLflow entries