CVE-2024-2928: MLflow Path Traversal Vulnerability

CVE-2024-2928 Overview

CVE-2024-2928 is a Local File Inclusion (LFI) vulnerability affecting mlflow/mlflow version 2.9.2. The flaw stems from improper validation of URI fragments for directory traversal sequences such as ../. Attackers can manipulate the fragment portion of a URI to read arbitrary files from the local file system, including sensitive resources like /etc/passwd. This issue is a bypass of a prior patch that only sanitized the query string portion of URIs, leaving fragment handling exposed. The vulnerability is tracked under CWE-22 (Path Traversal) and CWE-29 (Path Traversal: \..\filename). The issue was fixed in MLflow version 2.11.3.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the MLflow server's local file system, potentially exposing credentials, configuration data, and sensitive machine learning artifacts.

Affected Products

MLflow versions prior to 2.11.3
MLflow version 2.9.2 (confirmed vulnerable)
LF Projects mlflow package distributions

Discovery Timeline

2024-06-06 - CVE-2024-2928 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2928

Vulnerability Analysis

MLflow exposes a tracking server that processes URIs supplied to artifact and model registry endpoints. The vulnerable code path failed to sanitize the fragment component of incoming URIs against directory traversal sequences. An attacker submits a crafted URI containing ../ sequences in the fragment, and the server resolves the path against the local file system. This allows the attacker to escape the intended artifact directory and read files outside the application's scope. Because MLflow servers often run with elevated privileges and host machine learning models alongside configuration files, the impact extends to disclosure of cloud credentials, API tokens, and training data references.

Root Cause

The root cause is incomplete input validation in MLflow's URI parsing logic. A previous patch addressed traversal sequences within the URI query string but did not extend the same validation to URI fragments. The application's URI handler treated the fragment as a trusted path component, passing it directly to file resolution routines without normalizing or canonicalizing the path. This selective sanitization left a parallel attack surface available through a different URI component.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP request to a vulnerable MLflow endpoint with a URI containing traversal sequences in the fragment, such as a path concatenated with #/../../../../etc/passwd. The MLflow server resolves the manipulated fragment and returns the contents of the targeted file. The EPSS score of 21.847% places this vulnerability in the 97th percentile, indicating significant exploitation likelihood relative to other published CVEs. The fix is documented in the upstream commit 96f0b573a73d8eedd6735a2ce26e08859527be07.

No verified proof-of-concept code is published. Refer to the MLflow patch commit and the Huntr bounty report for technical specifics.

Detection Methods for CVE-2024-2928

Indicators of Compromise

HTTP requests to MLflow endpoints containing ../ or URL-encoded %2e%2e%2f sequences within the URI fragment component
Access log entries referencing system files such as /etc/passwd, /etc/shadow, or cloud metadata paths through MLflow URIs
Outbound data flows from MLflow hosts to unexpected external IP addresses following anomalous URI requests
MLflow process file descriptors opened against paths outside the configured artifact root directory

Detection Strategies

Inspect web server and reverse proxy logs for URI fragments containing traversal sequences, including encoded variants
Deploy file integrity monitoring on MLflow host operating system files to catch unauthorized read patterns
Correlate MLflow access logs with process-level file access telemetry to identify reads outside the artifact store
Validate that MLflow server version reported in HTTP responses or API queries is 2.11.3 or later

Monitoring Recommendations

Alert on any MLflow HTTP request containing # followed by .. sequences in URI parameters
Monitor MLflow service accounts for unexpected file system reads outside the configured artifact root
Track MLflow instances across the environment using software inventory tools to identify unpatched deployments
Forward MLflow access logs to a centralized SIEM for retention and retrospective hunting against this vector

How to Mitigate CVE-2024-2928

Immediate Actions Required

Upgrade MLflow to version 2.11.3 or later across all tracking servers, model registries, and developer workstations
Restrict network access to MLflow endpoints using firewall rules or service mesh policies, limiting exposure to trusted clients only
Audit MLflow service accounts and reduce file system permissions to the minimum required for artifact storage operations
Review MLflow access logs for evidence of prior exploitation attempts referencing traversal sequences

Patch Information

The vulnerability is fixed in MLflow version 2.11.3. The upstream fix is committed as 96f0b573a73d8eedd6735a2ce26e08859527be07 and extends URI validation to cover fragment components in addition to query strings. See the MLflow patch commit for implementation details and the Huntr bounty report for vulnerability context.

Workarounds

Place MLflow behind an authenticating reverse proxy that strips or rejects URI fragments containing .. sequences
Run the MLflow server under a dedicated low-privilege user account with file system access restricted to the artifact directory using mandatory access controls
Deploy a web application firewall rule blocking requests with traversal patterns in any URI component including the fragment
Isolate MLflow on a dedicated host or container with no sensitive configuration files or credentials on the local file system

bash

# Upgrade MLflow to the patched release
pip install --upgrade 'mlflow>=2.11.3'

# Verify installed version
python -c "import mlflow; print(mlflow.__version__)"