Become a Member

Regulation TrackerLaws, orders and treaties read for their security duties and clocks Standards & FrameworksAttack taxonomies, control catalogues and frontier frameworks AI Incident DatabaseThe security incident record, with mechanism and lesson Research Paper LibraryThe papers that define the field, summarised OSS DirectoryRed teaming, guardrail, supply chain and evaluation tools Case StudiesProgrammes built, with measured outcomes AI Vulnerability TrackerCVEs and advisories for the components AI systems are built from

Latest in the tracker

New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act and implementing rulesNew York's law restricting algorithmic feeds for minors takes effect on 25 January 2027 under final rules published in July 2026, with certified age assurance and $5,000-per-violation penalties.

Knowledge Base Regulation Tracker Standards & Frameworks OSS Directory AI Incident Database Research Paper Library Case Studies Society Articles News Jobs About Charter Become a Member

Home/AI Incident Database/"ShellTorch" in TorchServe and critical MLflow flaws expose model-serving and MLOps servers to takeover

"ShellTorch" in TorchServe and critical MLflow flaws expose model-serving and MLOps servers to takeover

Researchers showed that internet-exposed TorchServe and MLflow servers could be taken over remotely to steal or replace models, one of the first systematic demonstrations that MLOps infrastructure carries critical vulnerabilities.

Under reviewSeverity: Hightorchservemlflowmlopsrce

At a glance

Organisation: PyTorch Foundation; MLflow (Databricks); Oligo; Protect AI
Industry: Cloud and infrastructure
Country or region: Global
Occurred: 1 Aug 2023
Disclosed: 3 Oct 2023
Type of harm: Remote code execution, Model or data tampering, Model theft and extraction

All details 14

Kind of system: ML pipelines and development tooling
Severity: High
Confirmation: Demonstrated by researchers
Tools involved: TorchServe management API, MLflow
Technique: Server-side request forgery and unsafe deserialisation (CVE-2023-43654); path traversal in MLflow (CVE-2023-6977 and others)
Primary root cause: Vulnerable dependency or package
Scale: Tens of thousands of exposed instances including at major companies
Outcome: Patched by maintainers (TorchServe 0.8.2, MLflow 2.x releases) after bug-bounty disclosures; the wave of MLOps CVEs in 2023-24 established the category.

Sources

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit incident Report a correction or request removal