TI-2022-00648 Aliases CVE-2022-0736 GHSA-vqj2-4v8m-8vrq

Insecure Temporary File in mlflow/mlflow

LOW 36CWE-377Published 2022-02-23 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-668 and the CVSS impact.

Summary

Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.

Why it matters now

EPSS 0.01575 75th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mlflow/mlflow (mlflow): 1.23.1mlflow (PyPI): 1.23.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
MLflow	mlflow/mlflow	before 1.23.1	1.23.1	Patch available	CNA
—	mlflow (PyPI)	before 1.23.1	1.23.1	Patch available	GHSA-vqj2-4v8m-8vrq

mlflow/mlflow VendorMLflow Affected before 1.23.1 Fixed in 1.23.1 Patch available CNA
mlflow (PyPI) Vendor— Affected before 1.23.1 Fixed in 1.23.1 Patch available GHSA-vqj2-4v8m-8vrq

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lfprojects:mlflow::::::::	before 1.23.1	Vulnerable	MLflow

cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* Versions before 1.23.1 Vulnerable ·MLflow

Remediation

Fix · CNA mlflow/mlflow (mlflow) Fixed in 1.23.1
Fix · GHSA-vqj2-4v8m-8vrq mlflow (PyPI) Fixed in 1.23.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2022-0736
2026-10-03 Alias added: GHSA-vqj2-4v8m-8vrq

References

Exploit 1

https://huntr.dev/bounties/e5384764-c583-4dec-a1d8-4697f4e12f75

Patch 1

https://github.com/mlflow/mlflow/commit/61984e6843d2e59235d82a580c529920cd8f3711

Advisory 2

Other 2

TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
TI-2023-02603 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8

See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences