Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-08 | 1 | General1 |
| 2026-05-04 | 1 | Active Exploitation1 |
| 2026-05-05 | 1 | Active Exploitation1 |
If this doesn't work, I'll be really pissed off 🗿... CVE-2021-46381 CVE-2022-0679 CVE-2023-1177 CVE-2024-12987 CVE-2025-47813 #NoHeartz #CVE #CommonVulnerabilitiesExposures #CyberNews #CyberAttack https://t.co/hrDFVeNHj0
Post summary
The tweet merely lists several CVE identifiers without providing any additional context or details about exploits, patches, or vulnerability specifics.
MLOps (MLflow Tracking) — 11 instances, 100% unauthenticated — and 18% actively being exploited via CVE-2023-1177, with attacker-injected experiments doubling overnight between probes
Post summary
The passage reports that 18% of the identified MLflow Tracking instances are being actively exploited through CVE‑2023‑1177, with attacker‑injected experiments doubling overnight.
visible attacker activity. dozens of attacker-injected experiments. Same actor (matching 3BT8ncOzBWAH4GyIGz0EXsSwj7f ID) is spraying CVE-2023-1177 path-traversal payloads across vulnerable MLflow servers in the wild, harvesting SSH keys. https://t.co/tsj8jap8cg
Post summary
Attackers are actively exploiting CVE‑2023‑1177 on MLflow servers, using path‑traversal payloads to harvest SSH keys.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | lfprojects | mlflow | - | - | - |