CVE-2023-6976: Lfprojects MLflow

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

Affected products

• Lfprojects MLflow: before 2.9.2 (fixed in 2.9.2)

Published 2023-12-20. Last modified 2026-06-17.