Patch Ticker

MLflow get-artifacts flaw leaks server information

Anyone can peek at important data on this experiment-tracking server.

Summary

The get-artifacts function in MLflow does not properly validate a URI, letting a remote attacker disclose information from the server. The record says no authentication is needed to exploit it.

What to do

We have not confirmed a fixed version yet. Check the source links below.

Products and platforms

  • MLflow

CVE IDs

Times

First published

First seen