CVE-2023-6018

An attacker can overwrite any file on the server hosting MLflow without any authentication.

• CWE-78

• https://huntr.com/bounties/7cf918b5-43f4-48c0-a371-4d963ce69b30Exploit, Technical Description, Third Party Advisory
• https://huntr.com/bounties/7cf918b5-43f4-48c0-a371-4d963ce69b30Exploit, Technical Description, Third Party Advisory

Published

Nov 16, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-6012An improper input validation vulnerability has been found in…9.8
• CVE-2023-6013H2O is vulnerable to stored XSS vulnerability which can lead…5.4
• CVE-2023-6014An attacker is able to arbitrarily create an account in MLfl…9.8
• CVE-2023-6015MLflow allowed arbitrary files to be PUT onto the server.7.5
• CVE-2023-6016An attacker is able to gain remote code execution on a serve…9.8
• CVE-2023-6017H2O included a reference to an S3 bucket that no longer exis…7.1
• CVE-2023-6019A command injection existed in Ray's cpu_profile URL paramet…9.8
• CVE-2023-6020LFI in Ray's /static/ directory allows attackers to read any…7.5
• CVE-2023-6021LFI in Ray's log API endpoint allows attackers to read any f…7.5
• CVE-2023-6022Cross-Site Request Forgery (CSRF) in GitHub repository prefe…8.8
• CVE-2023-6023An attacker can read any file on the filesystem on the serve…7.5
• CVE-2023-6026A Path traversal vulnerability has been reported in elijaa/p…9.1