CVE-2023-6753 — HIGH (CVSS 8.8) AI Security Vulnerability

CISO Take

Any MLflow deployment prior to 2.9.2 accessible over the network is at serious risk — path traversal allows reading credentials, model artifacts, and system files. Patch immediately to 2.9.2+ and treat any exposed MLflow instance as potentially compromised. User interaction is required to trigger the exploit, making phishing or insider threat the likely delivery vector.

Risk Assessment

High risk in practice. CVSS 8.8 reflects low attack complexity and no privileges required once a user interacts — a low bar in MLOps environments where data scientists routinely open links and download artifacts. MLflow instances are often deployed with broad filesystem access to model stores, training datasets, and cloud credentials. The combination of network exposure, high CIA impact, and MLflow's typical deployment posture (privileged, internally trusted) elevates real-world risk beyond the raw score.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
mlflow	pip	—	No patch
25.8K OpenSSF 4.5 624 dependents Pushed today 24% patched ~64d to patch Full package profile →

Do you use mlflow? You're affected.

Severity & Risk

CVSS 3.1

8.8 / 10

EPSS

2.4%

chance of exploitation in 30 days

Higher than 85% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI Required

S Unchanged

C High

I High

A High

Recommended Action

6 steps

Patch immediately: upgrade mlflow to >= 2.9.2.
If patching is not immediately possible: restrict MLflow UI/API access to VPN/internal networks only via firewall rules — do not expose MLflow to the public internet.
Audit MLflow deployment permissions: run MLflow with a least-privilege service account; do not run as root or with cloud admin credentials.
Review artifact store contents for unauthorized access: check access logs for unusual file path patterns (e.g., '../', '%2e%2e').
Rotate any credentials stored in files accessible from the MLflow working directory.
Enable filesystem auditing (auditd on Linux) on MLflow hosts to detect traversal attempts.

CISA SSVC Assessment

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Data Extraction Code Execution Supply Chain Framework Training Data Model AML.T0011 - User Execution AML.T0025 - Exfiltration via Cyber Means AML.T0035 - AI Artifact Collection AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity for high-risk AI systems

ISO 42001

A.6.2.6 - AI system security and resilience

NIST AI RMF

MANAGE 2.2 - Mechanisms are in place to respond to and recover from AI risks

OWASP LLM Top 10

LLM05:2023 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2023-6753?

Any MLflow deployment prior to 2.9.2 accessible over the network is at serious risk — path traversal allows reading credentials, model artifacts, and system files. Patch immediately to 2.9.2+ and treat any exposed MLflow instance as potentially compromised. User interaction is required to trigger the exploit, making phishing or insider threat the likely delivery vector.

Is CVE-2023-6753 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2023-6753, increasing the risk of exploitation.

How to fix CVE-2023-6753?

1. Patch immediately: upgrade mlflow to >= 2.9.2. 2. If patching is not immediately possible: restrict MLflow UI/API access to VPN/internal networks only via firewall rules — do not expose MLflow to the public internet. 3. Audit MLflow deployment permissions: run MLflow with a least-privilege service account; do not run as root or with cloud admin credentials. 4. Review artifact store contents for unauthorized access: check access logs for unusual file path patterns (e.g., '../', '%2e%2e'). 5. Rotate any credentials stored in files accessible from the MLflow working directory. 6. Enable filesystem auditing (auditd on Linux) on MLflow hosts to detect traversal attempts.

What systems are affected by CVE-2023-6753?

This vulnerability affects the following AI/ML architecture patterns: training pipelines, model registry, experiment tracking systems, MLOps platforms, CI/CD model deployment pipelines.

What is the CVSS score for CVE-2023-6753?

CVE-2023-6753 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 2.42%.

Technical Details

NVD Description

Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.

Exploitation Scenario

An attacker identifies an organization's MLflow tracking server exposed on an internal network. They craft a malicious experiment artifact or shareable link containing a path traversal sequence (e.g., `../../etc/passwd` or `../../.aws/credentials`). When a legitimate MLflow user — a data scientist reviewing experiment results — clicks the link or downloads the artifact, the traversal executes server-side and returns the target file contents. The attacker exfiltrates AWS credentials stored on the MLflow host, then pivots to access the S3 artifact store containing proprietary model weights and training datasets. With write primitives confirmed, they overwrite a production model artifact with a backdoored version.