CVE-2023-6014: MLflow authentication bypass allows arbitrary account creation

Summary

CVE-2023-6014 is a flaw in MLflow that lets an attacker create an account arbitrarily, bypassing any authentication requirement. The weakness is classified as CWE-598, Use of GET Request Method With Sensitive Query Strings. NVD had not yet provided an assessment when the entry was published on 11/16/2023.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoTraceRouter++: Causal Semantic Routing Realignment via Optimal TransportSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoCrowdStrike to Acquire Dreadnode to Bring Automated AI Security Testing to the Falcon PlatformSimilar attack · CrowdStrike Blog