SZB-60509c69f2
Zero Day Initiative discloses MLflow flaw that could expose sensitive internal data
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- MLflow
- Product
- MLflow
- First seen
Summary
Zero Day Initiative published advisory ZDI-26-847 describing a security flaw in MLflow. According to the item, the flaw could allow unauthorized people to access sensitive internal data; the item gives no CVSS score or CVE identifier.
If you use MLflow
Identify MLflow deployments and their versions.
Check the ZDI advisory and the MLflow project for an official fix, and apply it when available.
Restrict network access to MLflow tracking servers until patched.
Review MLflow server logs for unexpected access.
What the sources say 1
· Mastodon: “A security flaw in the MLflow software could allow unauthorized people to access sensitive internal data.” Source