CVE-2022-0736
Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Record
CVE-2022-0736- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
EUVDEUVD-2022-0158
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Record
EUVD-2022-0158- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vqj2-4v8m-8vrq
Insecure Temporary File in mlflow
mlflow prior to 1.23.1 contains an insecure temporary file. The insecure function tempfile.mktemp() is deprecated and mkstemp() should be used instead.
- Record
GHSA-vqj2-4v8m-8vrq- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-377, CWE-668
- Updated
- 2026-11-02
NVD
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Record
CVE-2022-0736- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-377
- Updated
- 2026-11-02
OSV
Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Record
CVE-2022-0736- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
OSVGHSA-vqj2-4v8m-8vrq
Insecure Temporary File in mlflow
mlflow prior to 1.23.1 contains an insecure temporary file. The insecure function tempfile.mktemp() is deprecated and mkstemp() should be used instead.
- Record
GHSA-vqj2-4v8m-8vrq- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.2 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H - Weakness
- CWE-377, CWE-668
- Updated
- 2026-11-02
OSVBIT-mlflow-2022-0736 No score
Insecure Temporary File in mlflow/mlflow
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Record
BIT-mlflow-2022-0736- Updated
- 2026-11-02
OSVPYSEC-2022-28 No score
Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
- Record
PYSEC-2022-28- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mlflowPyPI |
before 1.23.1 | 1.23.1 |
mlflowBitnami |
before 1.23.1 | 1.23.1 |
mlflowPyPI |
before 1.23.1, plus listed versions 0.0.10.1.00.2.00.2.10.3.0 Show 45 moreShow less0.4.00.4.10.4.20.5.00.5.10.5.20.6.00.7.00.8.00.8.10.8.20.9.00.9.0.10.9.11.0.01.1.01.1.1.dev01.10.01.11.01.12.01.12.11.131.13.11.14.01.14.11.15.01.16.01.17.01.18.01.19.01.2.01.20.01.20.11.20.21.21.01.22.01.23.01.3.01.4.01.5.01.6.01.7.01.7.11.7.21.8.0 |
1.23.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0736 is a high vulnerability (CVSS 8.2) in Lfprojects Mlflow, published February 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in mlflow 1.23.1.
References
huntr.dev/bounties/e5384764-c583-4dec-a1d8-4697f4e12f75
github.com/mlflow/mlflow/commit/61984e6843d2e59235d82a580c529920cd8f3711
nvd.nist.gov/vuln/detail/CVE-2022-0736
Left out here: 2 versions. The JSON record has them.