GHSA-qpgc-w4mg-6v92HighCVSS 7.0
MLflow's excessive directory permissions allow local privilege escalation
🔗 CVE IDs covered (1)
📋 Description
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
🎯 Affected products1
- pip/mlflow:< 2.16.0