MLflow authentication requirement bypass can allow a user to arbitrarily create an account

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-6014 · ADVISORY
• mlflow/mlflow · WEB
• mlflow/mlflow#9700 · WEB
• mlflow/mlflow commit 32de215 · WEB
• mlflow/mlflow · PACKAGE
• mlflow/mlflow release v2.8.0 · WEB
• huntr.com/bounties/3e64df69-ddc2-463e-9809-d07c24dc1de4 · WEB
• pypi.org/project/mlflow · PACKAGE
• GitHub Advisory GHSA-4qq5-mxxx-m6gg · ADVISORY

mlflow의 다른 취약점

• CVE-2026-116692심각 9.8MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0…
• CVE-2026-116691보통 6.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, m…
• CVE-2026-116690높음 7.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, t…
• CVE-2026-115886보통 6.5MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.12.0rc0 until 3.17.0…
• CVE-2026-53995높음 8.2MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to…