{"id":"CVE-2023-6977","aliases":["GHSA-qg8p-32gr-gh6x","BIT-mlflow-2023-6977","PYSEC-2026-1659"],"title":"MLflow Local File Disclosure Vulnerability","summary":"MLflow Local File Disclosure Vulnerability","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","vendor":"mlflow","product":"mlflow","ecosystem":"pip","affected":["mlflow < 2.9.2"],"patched":["mlflow 2.9.2"],"published":"2023-12-20","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qg8p-32gr-gh6x","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6977"},{"url":"https://github.com/mlflow/mlflow/commit/4bd7f27c810ba7487d53ed5ef1038fca0f8dc28c"},{"url":"https://github.com/mlflow/mlflow"},{"url":"https://huntr.com/bounties/fe53bf71-3687-4711-90df-c26172880aaf"}],"tags":["osv","pip","exploit-available"],"epss":0.03924,"epssPercentile":0.89887,"ingestedAt":"2026-07-08T18:25:52.415Z","exploits":{"nuclei":["CVE-2023-6977"],"checkedAt":"2026-09-23T07:13:26.430Z"},"exploitAvailable":true,"slug":"CVE-2023-6977","body":"## Overview\n\nThis vulnerability enables malicious users to read sensitive files on the server.\n\n## Affected packages\n\n- `mlflow < 2.9.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `mlflow 2.9.2`","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":41.3,"likelihood":0.8,"exploitation":12,"ransomware":0},"changes":[{"seq":4673,"id":"CVE-2023-6977","ts":1788887198142,"field":"exploit_available","old":"false","new":"true"},{"seq":3556,"id":"CVE-2023-6977","ts":1788886314320,"field":"exploit_available","old":"true","new":"false"},{"seq":2410,"id":"CVE-2023-6977","ts":1788882983530,"field":"exploit_available","old":"false","new":"true"},{"seq":1439,"id":"CVE-2023-6977","ts":1788882396495,"field":"exploit_available","old":"true","new":"false"},{"seq":553,"id":"CVE-2023-6977","ts":1788881832824,"field":"exploit_available","old":"false","new":"true"}]}