| Package | Affected versions | Patched versions |
|---|---|---|
| mlflow | < 2.16.0 | 2.16.0 |
| mlflow | < 2.16.0 | 2.16.0 |
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free