CVE-2023-1176

Low

Advisory

Published 24 Mar 2023In the index since 8 Sept 2026

Severity: Low; worst across findings
CVSS: 3.3; base score, highest
EPSS: 0.006; 46th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 7; of 17,781 indexed, latest versions
Container images: 7; deployed by those charts
Fix available: 1 of 1; affected package

Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs

Carried by container images the latest versions of 7 of 17,781 indexed charts deploy, on 7 images.

Affected package	Affected versions	Fixed in	Images
mlflowpypi	1.9.1, 1.25.0, 1.26.1, 1.30.1+2 more	2.2.1, 2.2.2	7

OSV records: GHSA-wp72-7hj9-5265 PYSEC-2023-28
Also known as: BIT-mlflow-2023-1176

Charts affected

7 by stars

Chart

Latest

Affected images

Radar Score

mlflow-controllermlflow-deployment-controller

0.1.8

2 of 2 See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2023-1176.

Container image	Digest	Package	Fixed in
tachyongroup/mlflow-deployment-controller :mlflow-controller-0.1.8	7e79b9000856	mlflow@1.25.0	2.2.1
tachyongroup/mlflow-deployment-controller-ui :mlflow-controller-0.1.8	f4f7fabe1037	mlflow@2.1.1	2.2.1

Open the chart page →

8,957

mlflow-servermlflowserver

0.1.9

1 of 3 See more

mlflow-server mlflowserver 0.1.9

1 of the 3 container images this version deploys carry CVE-2023-1176.

Container image	Digest	Package	Fixed in
buntha/mlflow :2.1.1	154542cc3083	mlflow@2.1.1	2.2.1

Open the chart page →

5,804

mlflowdeliveryhero

1.0.10

1 of 1 See more

mlflow deliveryhero 1.0.10

1 of the 1 container images this version deploys carry CVE-2023-1176.

Container image	Digest	Package	Fixed in
larribas/mlflow :1.9.1	05ccb0b46bfb	mlflow@1.9.1	2.2.1

Open the chart page →

4,422

mlflowhelm-charts-nr

1.0.10

1 of 1 See more

mlflow helm-charts-nr 1.0.10

1 of the 1 container images this version deploys carry CVE-2023-1176.

Container image	Digest	Package	Fixed in
larribas/mlflow :1.9.1	05ccb0b46bfb	mlflow@1.9.1	2.2.1

Open the chart page →

4,422

mlflowkelvins

0.4.0

1 of 3 See more

mlflow kelvins 0.4.0

1 of the 3 container images this version deploys carry CVE-2023-1176.

Container image	Digest	Package	Fixed in
kelvinsp/mlflow :1.26.1	cd33e6db2a59	mlflow@1.26.1	2.2.1

Open the chart page →

4,156

mlflow-servermlflow-server

0.3.0

1 of 1 See more

mlflow-server mlflow-server 0.3.0

1 of the 1 container images this version deploys carry CVE-2023-1176.

Container image	Digest	Package	Fixed in
ghcr.io/mlops-for-all/mlflow-tracking-server :3.8-1.30.1-v1.0.0	d30e631684c3	mlflow@1.30.1	2.2.1

Open the chart page →

3,158

mlflowncsa

1.2.1

1 of 4 See more

5,456

Container images carrying it

7 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
larribas/mlflow :1.9.1	05ccb0b46bfb	mlflow@1.9.1	2.2.1	2
buntha/mlflow :2.1.1	154542cc3083	mlflow@2.1.1	2.2.1	1
evk02/mlflow :2.2.1	ef6ff257ef35	mlflow@2.2.1	2.2.2	1
kelvinsp/mlflow :1.26.1	cd33e6db2a59	mlflow@1.26.1	2.2.1	1
tachyongroup/mlflow-deployment-controller :mlflow-controller-0.1.8	7e79b9000856	mlflow@1.25.0	2.2.1	1
tachyongroup/mlflow-deployment-controller-ui :mlflow-controller-0.1.8	f4f7fabe1037	mlflow@2.1.1	2.2.1	1
ghcr.io/mlops-for-all/mlflow-tracking-server :3.8-1.30.1-v1.0.0	d30e631684c3	mlflow@1.30.1	2.2.1	1