GHSA-qpgc-w4mg-6v92
MLflow's excessive directory permissions allow local privilege escalation
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a local attacker to gain elevated permissions by using a ToCToU attack. The issue is only relevant when the spark_udf() MLflow API is called.
References
External links from the advisory. They lead to third-party sites.