{"action":"Upgrade mlflow to 2.9.0 or later.","affected":[{"fixed":"2.9.0","introduced":"0"}],"component":"mlflow","cve_ids":["CVE-2023-43472"],"ecosystem":"PyPI","epss":0.36582,"exploited":false,"fixed_versions":["2.9.0"],"ghsa_id":"GHSA-wqxf-447m-6f5f","id":"tcs_01M5KGTY6CVQRGCX4V28G0A12H","modified_at":"2026-07-07T17:56:44.314962290Z","published_at":"2026-07-07T11:45:28.122612Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1661","https://nvd.nist.gov/vuln/detail/CVE-2023-43472","https://github.com/mlflow/mlflow","https://mlflow.org/news/2023/12/06/2.9.0-release/index.html","https://www.contrastsecurity.com/security-influencers/discovering-mlflow-framework-zero-day-vulnerability-machine-language-model-security-contrast-security","https://pypi.org/project/mlflow","https://github.com/advisories/GHSA-wqxf-447m-6f5f"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1661","url":"https://osv.dev/vulnerability/PYSEC-2026-1661"}],"summary":"Information exposure in MLflow"}