CVE-2023-6014 CRITICAL

CVE-2023-6014: MLflow Authentication Bypass

Vendor Mlflow
Product mlflow/mlflow
Weakness CWE-598
Published November 16, 2023
Last update September 4, 2024
View on NVD All CVEs

CVSS base score

9.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment.

Key dates

02Disclosure timeline

November 16, 2023 CVE published
September 4, 2024 Record updated