CVE-2023-6018
MLflow Arbitrary File Write
An attacker can overwrite any file on the server hosting MLflow without any authentication.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MLflow Arbitrary File Write
An attacker can overwrite any file on the server hosting MLflow without any authentication.
- Record
CVE-2023-6018- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
EUVDEUVD-2023-2888
An attacker can overwrite any file on the server hosting MLflow without any authentication.
- Record
EUVD-2023-2888- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5p3h-7fwh-92rc
Remote Code Execution due to Full Controled File Write in mlflow
The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution (like overwriting /home/<user>/.bashrc). A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
- Record
GHSA-5p3h-7fwh-92rc- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
An attacker can overwrite any file on the server hosting MLflow without any authentication.
- Record
CVE-2023-6018- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVGHSA-5p3h-7fwh-92rc
Remote Code Execution due to Full Controled File Write in mlflow
The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution (like overwriting /home/<user>/.bashrc). A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
- Record
GHSA-5p3h-7fwh-92rc- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
OSVPYSEC-2026-417
Remote Code Execution due to Full Controled File Write in mlflow
The mlflow web server includes tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. As this vulnerability allows to write / overwrite any file on the file system, it gives a lot of ways to archive code execution (like overwriting /home/<user>/.bashrc). A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information.
- Record
PYSEC-2026-417- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-mlflow-2023-6018 No score
An attacker can overwrite any file on the server hosting MLflow without any authentication.
- Record
BIT-mlflow-2023-6018- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mlflowPyPI |
through 2.8.1 | 2.9.2 |
mlflowBitnami |
Not stated | Not evaluated |
mlflowPyPI |
before 2.9.2, plus listed versions 0.0.10.1.00.2.00.2.10.3.0 Show 45 moreShow less0.4.00.4.10.4.20.5.00.5.10.5.20.6.00.7.00.8.00.8.10.8.20.9.00.9.0.10.9.11.0.01.1.01.1.1.dev01.10.01.11.01.12.01.12.11.131.13.11.14.01.14.11.15.01.16.01.17.01.18.01.19.01.2.01.20.01.20.11.20.21.21.01.22.01.23.01.23.11.24.01.25.01.25.11.26.01.26.11.27.01.28.0 |
2.9.2 |
Not evaluated means the source gave git commits or a range we can't read, so we can't tell which releases are affected. A fixed version beside it is the source’s own claim.
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Mlflow - Arbitrary File Write |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-6018 is a critical vulnerability (CVSS 10.0) in Lfprojects Mlflow, published November 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 47.9%, the 98th percentile. Fixed in mlflow 2.9.2.
References
Left out here: 35 versions. The JSON record has them.