CVE-2024-1593 — HIGH (CVSS 7.5) AI Security Vulnerability

CISO Take

MLflow's unauthenticated path traversal (no privileges, no user interaction, network-accessible) means any exposed MLflow instance is a direct file read target. Attackers can exfiltrate model artifacts, training data, and credential files stored on the MLflow server. Patch immediately or isolate all MLflow instances behind VPN/firewall — this is not a theoretical risk on public-facing deployments.

Risk Assessment

HIGH operational risk for AI/ML teams. CVSS 7.5 understates exposure in practice: MLflow instances are frequently deployed on internal networks with broad team access or, worse, publicly exposed for collaboration. The attack requires zero authentication and zero user interaction, making automated scanning and exploitation trivial. The ';' parameter smuggling technique is a known bypass category that WAFs often miss. MLflow servers typically sit at the core of ML pipelines and store or reference sensitive artifacts — credentials in .env files, cloud provider tokens, model weights, and training datasets are all reachable via file traversal.

Affected Systems

Package	Ecosystem	Vulnerable Range	Patched
mlflow	pip	—	No patch
25.7K OpenSSF 4.5 624 dependents Pushed 7d ago 24% patched ~64d to patch Full package profile →

Do you use mlflow? You're affected.

Severity & Risk

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, CISA SSVC, EPSS, trickest/cve, and Nuclei templates.

Attack Surface

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I None

A None

Recommended Action

6 steps

PATCH

Upgrade MLflow to the version that resolves CVE-2024-1593 (check huntr advisory for specific patched version).
NETWORK ISOLATION

Immediately restrict MLflow UI/API to internal network or VPN-only access — no MLflow instance should be internet-facing without auth.
WAF RULE

Add detection for ';' characters in URL path parameters targeting MLflow endpoints.
AUDIT LOGS

Review MLflow access logs for requests containing semicolons (';') in URL params, especially targeting file paths or artifact endpoints.
SECRETS HYGIENE

Audit that no credentials, API keys, or cloud tokens are stored in directories accessible to the MLflow artifact store.
LEAST PRIVILEGE

Ensure MLflow server process runs with minimal filesystem permissions — restrict to artifact store directory only.

CISA SSVC Assessment

Decision Track*

Exploitation poc

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

Classification

Data Extraction Auth Bypass Framework Training Data AML.T0025 - Exfiltration via Cyber Means AML.T0035 - AI Artifact Collection AML.T0037 - Data from Local System AML.T0049 - Exploit Public-Facing Application

Compliance Impact

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Security of AI system components

NIST AI RMF

MANAGE 2.2 - Mechanisms to respond to AI risks

OWASP LLM Top 10

LLM08 - Excessive Agency / Insecure Plugin Design

Frequently Asked Questions

What is CVE-2024-1593?

MLflow's unauthenticated path traversal (no privileges, no user interaction, network-accessible) means any exposed MLflow instance is a direct file read target. Attackers can exfiltrate model artifacts, training data, and credential files stored on the MLflow server. Patch immediately or isolate all MLflow instances behind VPN/firewall — this is not a theoretical risk on public-facing deployments.

Is CVE-2024-1593 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-1593, increasing the risk of exploitation.

How to fix CVE-2024-1593?

1. PATCH: Upgrade MLflow to the version that resolves CVE-2024-1593 (check huntr advisory for specific patched version). 2. NETWORK ISOLATION: Immediately restrict MLflow UI/API to internal network or VPN-only access — no MLflow instance should be internet-facing without auth. 3. WAF RULE: Add detection for ';' characters in URL path parameters targeting MLflow endpoints. 4. AUDIT LOGS: Review MLflow access logs for requests containing semicolons (';') in URL params, especially targeting file paths or artifact endpoints. 5. SECRETS HYGIENE: Audit that no credentials, API keys, or cloud tokens are stored in directories accessible to the MLflow artifact store. 6. LEAST PRIVILEGE: Ensure MLflow server process runs with minimal filesystem permissions — restrict to artifact store directory only.

What systems are affected by CVE-2024-1593?

This vulnerability affects the following AI/ML architecture patterns: MLOps pipelines, model registry, training pipelines, experiment tracking infrastructure, model serving.

What is the CVSS score for CVE-2024-1593?

CVE-2024-1593 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.31%.

Technical Details

NVD Description

A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using the ';' character in URLs, attackers can manipulate the 'params' portion of the URL to gain unauthorized access to files or directories. This vulnerability allows for arbitrary data smuggling into the 'params' part of the URL, enabling attacks similar to those described in previous reports but utilizing the ';' character for parameter smuggling. Successful exploitation could lead to unauthorized information disclosure or server compromise.

Exploitation Scenario

An adversary conducting reconnaissance against a target's ML infrastructure identifies an exposed MLflow tracking server (common in data science teams using default deployments). They craft a URL to the MLflow REST API embedding a path traversal sequence using ';' as a parameter delimiter to escape the intended path scope — e.g., targeting the artifact download or file serving endpoint. By iterating traversal payloads, the attacker reads /etc/passwd to confirm traversal works, then pivots to targeting ~/.aws/credentials, .env files, or MLflow's own database configuration. Cloud storage keys recovered can then be used to exfiltrate the full model artifact store, including proprietary model weights, training data, and experiment metadata.