CVE-2023-2356
Description
A flaw was found in MLflow. A remote attacker can submit crafted requests containing path traversal sequences to bypass restricted directory boundaries on the server. Successful exploitation allows the attacker to access, read, or overwrite arbitrary files on the host filesystem, resulting in sensitive data disclosure or system tampering.
Statement
This vulnerability is rated as Important for Red Hat environments running MLflow tracking servers, because an unauthenticated remote attacker can exploit improper path resolution to access and manipulate sensitive files outside the intended storage directories. Because tracking servers are often deployed to coordinate machine learning workloads across distributed nodes, exposing the service without network perimeter controls allows arbitrary read and write operations on the underlying host filesystem. This widespread potential for complete confidentiality and integrity compromise without requiring user interaction justifies the critical rating.
Mitigation
Restrict network access to the MLflow tracking server so that it is accessible only from trusted administrative networks or localhost. If MLflow is hosted on Red Hat Enterprise Linux, firewall rules can be configured to block untrusted external traffic to the service port (default TCP 5000):
# firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_CIDR>
# firewall-cmd --permanent --zone=public --remove-port=5000/tcp
# firewall-cmd --reload
Caveats: Restricting network reachability prevents unauthorized or external clients from querying metrics or logging artifacts. Applying firewall configuration changes via reload may temporarily disrupt active network connections.
--- CME Mitigation Guidance (2026-11-04) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to validate and canonicalize model version source URIs within tracking server handlers to reject paths containing relative directory traversal sequences: upgrade to mlflow 2.3.1, which reject non-local source URIs whose resolved path component does not match the original path, closing crafted model version source URI containing relative path traversal sequences. Until patched, this is a concern on deployments running an accessible MLflow tracking server HTTP API, so restrict network reachability to the MLflow tracking server port to trusted administrative CIDRs or localhost using firewall rules. As a compensating measure, confine application filesystem access to designated artifact directories to limit exposure to arbitrary file reads, deploy a web application firewall to inspect incoming tracking API requests and block directory traversal patterns such as dot-dot-slash in URI parameters, and use Falco or eBPF runtime security tooling to detect anomalous host filesystem access initiated by the MLflow server process. These controls limit blast radius and contain exploitation, but they do not fix the underlying relative path traversal defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 10 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | None | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Execute Unauthorized Code or Commands
The attacker may be able to create or overwrite critical files that are used to execute code, such as programs or libraries.
Integrity
Technical Impact: Modify Files or Directories
The attacker may be able to overwrite or create critical files, such as programs, libraries, or important data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, appending a new account at the end of a password file may allow an attacker to bypass authentication.
Confidentiality
Technical Impact: Read Files or Directories
The attacker may be able to read the contents of unexpected files and expose sensitive data. If the targeted file is used for a security mechanism, then the attacker may be able to bypass that mechanism. For example, by reading a password file, the attacker could conduct brute force password guessing attacks in order to break into an account on the system.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
The attacker may be able to overwrite, delete, or corrupt unexpected critical files such as programs, libraries, or important data. This may prevent the product from working at all and in the case of protection mechanisms such as authentication, it has the potential to lock out product users.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
