AI Threat Alert
CVE-2023-6753: MLflow: path traversal exposes arbitrary file read/write
HIGH PoC AVAILABLE CISA: ATTENDAny MLflow deployment prior to 2.9.2 accessible over the network is at serious risk — path traversal allows reading credentials, model artifacts, and system files. Patch immediately to 2.9.2+ and treat any exposed MLflow instance as potentially compromised. User interaction is required to trigger the exploit, making phishing or insider threat the likely delivery vector.
What is the risk?
High risk in practice. CVSS 8.8 reflects low attack complexity and no privileges required once a user interacts — a low bar in MLOps environments where data scientists routinely open links and download artifacts. MLflow instances are often deployed with broad filesystem access to model stores, training datasets, and cloud credentials. The combination of network exposure, high CIA impact, and MLflow's typical deployment posture (privileged, internally trusted) elevates real-world risk beyond the raw score.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| MLflow | pip | — | No patch |
Do you use MLflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
6 steps-
Patch immediately: upgrade mlflow to >= 2.9.2.
-
If patching is not immediately possible: restrict MLflow UI/API access to VPN/internal networks only via firewall rules — do not expose MLflow to the public internet.
-
Audit MLflow deployment permissions: run MLflow with a least-privilege service account; do not run as root or with cloud admin credentials.
-
Review artifact store contents for unauthorized access: check access logs for unusual file path patterns (e.g., '../', '%2e%2e').
-
Rotate any credentials stored in files accessible from the MLflow working directory.
-
Enable filesystem auditing (auditd on Linux) on MLflow hosts to detect traversal attempts.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2023-6753?
Any MLflow deployment prior to 2.9.2 accessible over the network is at serious risk — path traversal allows reading credentials, model artifacts, and system files. Patch immediately to 2.9.2+ and treat any exposed MLflow instance as potentially compromised. User interaction is required to trigger the exploit, making phishing or insider threat the likely delivery vector.
Is CVE-2023-6753 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2023-6753, increasing the risk of exploitation.
How to fix CVE-2023-6753?
1. Patch immediately: upgrade mlflow to >= 2.9.2. 2. If patching is not immediately possible: restrict MLflow UI/API access to VPN/internal networks only via firewall rules — do not expose MLflow to the public internet. 3. Audit MLflow deployment permissions: run MLflow with a least-privilege service account; do not run as root or with cloud admin credentials. 4. Review artifact store contents for unauthorized access: check access logs for unusual file path patterns (e.g., '../', '%2e%2e'). 5. Rotate any credentials stored in files accessible from the MLflow working directory. 6. Enable filesystem auditing (auditd on Linux) on MLflow hosts to detect traversal attempts.
What systems are affected by CVE-2023-6753?
This vulnerability affects the following AI/ML architecture patterns: training pipelines, model registry, experiment tracking systems, MLOps platforms, CI/CD model deployment pipelines.
What is the CVSS score for CVE-2023-6753?
CVE-2023-6753 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 1.07%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011 User Execution AML.T0025 Exfiltration via Cyber Means AML.T0035 AI Artifact Collection AML.T0037 Data from Local System AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
Path Traversal in GitHub repository mlflow/mlflow prior to 2.9.2.
Exploitation Scenario
An attacker identifies an organization's MLflow tracking server exposed on an internal network. They craft a malicious experiment artifact or shareable link containing a path traversal sequence (e.g., `../../etc/passwd` or `../../.aws/credentials`). When a legitimate MLflow user — a data scientist reviewing experiment results — clicks the link or downloads the artifact, the traversal executes server-side and returns the target file contents. The attacker exfiltrates AWS credentials stored on the MLflow host, then pivots to access the S3 artifact store containing proprietary model weights and training datasets. With write primitives confirmed, they overwrite a production model artifact with a backdoored version.
Weaknesses (CWE)
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H References
Timeline
Related Vulnerabilities
CVE-2025-15379 10.0 MLflow: RCE via unsanitized model dependency specs
Same package: mlflow CVE-2023-3765 10.0 MLflow: path traversal allows arbitrary file read
Same package: mlflow CVE-2026-2635 9.8 mlflow: security flaw enables exploitation
Same package: mlflow CVE-2023-2780 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow CVE-2023-1177 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow