CVE-2023-6014
📋 TL;DR
This vulnerability allows unauthenticated attackers to create arbitrary user accounts in MLflow deployments, bypassing all authentication requirements. Any organization using MLflow for machine learning workflow management is affected. The flaw enables complete account takeover and privilege escalation.
💻 Affected Systems
- MLflow
📦 What is this software?
Mlflow by Lfprojects
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of MLflow instance with administrative privileges, data exfiltration, injection of malicious models, and lateral movement to connected systems.
Likely Case
Unauthorized users gain access to sensitive ML models, training data, and pipeline configurations, potentially leading to intellectual property theft or model poisoning.
If Mitigated
Limited impact if MLflow is deployed in isolated environments without internet access and with strict network segmentation.
🎯 Exploit Status
The exploit requires sending specially crafted HTTP requests to the MLflow API endpoints. No authentication or special privileges are needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.9.2 and later
Vendor Advisory: https://github.com/mlflow/mlflow/security/advisories/GHSA-4hq8-xrvm-6hx5
Restart Required: Yes
Instructions:
1. Upgrade MLflow to version 2.9.2 or later using pip: 'pip install --upgrade mlflow>=2.9.2' 2. Restart all MLflow services 3. Verify the authentication mechanism is working correctly
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to MLflow instances using firewall rules
Reverse Proxy Authentication
allImplement authentication at the reverse proxy layer before requests reach MLflow
🧯 If You Can't Patch
- Deploy MLflow behind a reverse proxy with strong authentication (OAuth, SAML, or API key validation)
- Implement network segmentation to isolate MLflow from untrusted networks and monitor all access attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to create a user account via the MLflow API without authentication. If successful, the system is vulnerable.Check Version:
python -c "import mlflow; print(mlflow.__version__)"Verify Fix Applied:
After patching, attempt the same unauthenticated account creation. It should fail with proper authentication errors.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful account creation
- User account creation from unexpected IP addresses
- Authentication bypass patterns in access logs
Network Indicators:
- Unusual HTTP POST requests to /api/2.0/mlflow/users/create endpoint without authentication headers
- Account creation requests from unauthorized sources
SIEM Query:
source="mlflow.logs" AND (event="user_created" OR uri_path="/api/2.0/mlflow/users/create") AND NOT (auth_token EXISTS)