CVE-2024-1594 Overview
CVE-2024-1594 is a path traversal vulnerability in the mlflow/mlflow repository. The flaw exists in how MLflow processes the artifact_location parameter when a user creates an experiment. Attackers supply a URI containing a fragment component (#) to escape the intended artifact directory. Exploitation allows arbitrary file read on the server in the context of the MLflow process.
The issue mirrors CVE-2023-6909 but abuses a different URI component to bypass validation. MLflow is widely deployed for machine learning lifecycle management, exposing tracking servers that often hold model artifacts and credentials.
Critical Impact
Unauthenticated remote attackers can read arbitrary files from the MLflow server, exposing configuration files, credentials, and sensitive machine learning artifacts.
Affected Products
- LF Projects MLflow (all versions prior to the fixed release)
- Self-hosted MLflow tracking servers
- MLflow deployments exposed to network access without upstream authentication
Discovery Timeline
- 2024-04-16 - CVE-2024-1594 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-1594
Vulnerability Analysis
The vulnerability [CWE-22] resides in the experiment creation workflow of MLflow. When a client calls the tracking API to create an experiment, the server accepts an artifact_location URI supplied by the caller. MLflow parses this URI to determine where artifacts should be stored. Insufficient normalization of the URI fragment (#) allows the parsed path to resolve outside the intended artifact root.
An attacker who submits a crafted URI can coerce MLflow into treating server-local paths as artifact locations. Subsequent artifact operations dereference those paths, returning file contents from arbitrary locations on the host filesystem. The attack requires only network reachability to the MLflow API and no prior authentication, because MLflow ships without built-in authentication by default.
Root Cause
MLflow's URI parser strips or mishandles the fragment component during validation but honors it during file resolution. This inconsistency between the validation logic and the file access logic breaks the security boundary. The parser fails to canonicalize the path and reject sequences that escape the artifact directory.
Attack Vector
The attacker issues an HTTP request to the /api/2.0/mlflow/experiments/create endpoint with an artifact_location value containing a fragment that points to sensitive paths such as /etc/passwd or application configuration files. The attacker then requests artifact listings or downloads against the newly created experiment. MLflow reads the target file and returns its contents. Full technical details are available in the Huntr Bounty Listing.
Detection Methods for CVE-2024-1594
Indicators of Compromise
- HTTP POST requests to /api/2.0/mlflow/experiments/create containing # characters inside the artifact_location field.
- Unexpected experiments in the MLflow database whose artifact_location references system paths such as /etc, /root, or C:\Windows.
- Artifact download requests returning file content that does not match expected MLOps assets.
Detection Strategies
- Inspect MLflow server logs for experiment creation calls that include URI fragments or absolute filesystem paths.
- Correlate artifact retrieval events with the experiments they belong to and flag reads outside the configured artifact root.
- Deploy web application firewall rules that block fragment characters in artifact_location values submitted to the MLflow API.
Monitoring Recommendations
- Enable verbose access logging on the MLflow tracking server and forward logs to a centralized analytics platform.
- Alert on any process spawned by the MLflow service that accesses files outside its designated artifact directory.
- Track outbound data volumes from the MLflow host to identify bulk exfiltration of files read through the vulnerability.
How to Mitigate CVE-2024-1594
Immediate Actions Required
- Upgrade MLflow to a version that patches CVE-2024-1594 as soon as the fix is available in your distribution channel.
- Restrict network access to the MLflow tracking server so it is not reachable from untrusted networks or the public internet.
- Place an authenticating reverse proxy in front of MLflow to require credentials before any API call reaches the tracking server.
Patch Information
The MLflow maintainers addressed the flaw by hardening URI parsing for the artifact_location parameter. Consult the Huntr Bounty Listing for the associated pull request and fixed version details. Deploy the upgrade to every MLflow tracking server and rebuild container images that embed MLflow.
Workarounds
- Configure MLflow to reject client-supplied artifact_location values and enforce a server-managed artifact root.
- Run the MLflow process under a low-privilege service account with filesystem access limited to the artifact directory.
- Apply mandatory access controls such as AppArmor or SELinux profiles that constrain the MLflow process to its working directories.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
