AI Threat Alert
CVE-2024-6838: MLflow: unconstrained input causes UI denial of service
GHSA-q3gw-8236-5jw4 MEDIUM PoC AVAILABLE CISA: TRACK*MLflow v2.13.2 and earlier allow unauthenticated network attackers to crash the UI by submitting experiment names with arbitrarily large integer strings—zero credentials required. If your data science teams run MLflow on accessible networks without an auth proxy, this is exploitable today. Restrict network access immediately, deploy an authentication layer, and plan an upgrade.
What is the risk?
CVSS 5.3 Medium with EPSS 0.00121—low likelihood of opportunistic exploitation in the wild, but the attack profile (network, no auth, no user interaction, low complexity) makes it trivially executable by any attacker with reachability. The real risk multiplier is organizational: MLflow instances are frequently stood up by data science teams without hardening or network segmentation. Not in CISA KEV. Impact is confined to UI availability; model serving and training jobs are not directly disrupted, but ML operations teams lose experiment visibility and model promotion capability.
What systems are affected?
How severe is it?
What is the attack surface?
What should I do?
6 steps-
Upgrade MLflow past v2.13.2 (monitor upstream GitHub releases for patch).
-
If immediate upgrade is blocked, firewall MLflow to trusted internal networks only—no public exposure.
-
Deploy an OAuth2 Proxy or reverse proxy with authentication in front of any MLflow instance; no production tracking server should be unauthenticated.
-
Add WAF or API gateway rules to reject experiment names exceeding 255 characters.
-
Audit existing experiments for anomalous artifact_location values (unexpected URIs, relative paths, internal hostnames).
-
Enable API access logging on MLflow; alert on high-volume experiment creation bursts from single IPs.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2024-6838?
MLflow v2.13.2 and earlier allow unauthenticated network attackers to crash the UI by submitting experiment names with arbitrarily large integer strings—zero credentials required. If your data science teams run MLflow on accessible networks without an auth proxy, this is exploitable today. Restrict network access immediately, deploy an authentication layer, and plan an upgrade.
Is CVE-2024-6838 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2024-6838, increasing the risk of exploitation.
How to fix CVE-2024-6838?
1. Upgrade MLflow past v2.13.2 (monitor upstream GitHub releases for patch). 2. If immediate upgrade is blocked, firewall MLflow to trusted internal networks only—no public exposure. 3. Deploy an OAuth2 Proxy or reverse proxy with authentication in front of any MLflow instance; no production tracking server should be unauthenticated. 4. Add WAF or API gateway rules to reject experiment names exceeding 255 characters. 5. Audit existing experiments for anomalous artifact_location values (unexpected URIs, relative paths, internal hostnames). 6. Enable API access logging on MLflow; alert on high-volume experiment creation bursts from single IPs.
What systems are affected by CVE-2024-6838?
This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, training pipelines, experiment tracking, model registry.
What is the CVSS score for CVE-2024-6838?
CVE-2024-6838 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.61%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029 Denial of AI Service AML.T0034 Cost Harvesting AML.T0049 Exploit Public-Facing Application Compliance Controls Affected
What are the technical details?
Original Advisory
In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment.
Exploitation Scenario
An attacker discovers an internet-facing MLflow tracking server—common in data science teams that launch `mlflow ui` without authentication. Using curl or a Python script, they POST to /api/2.0/mlflow/experiments/create with an experiment name field containing 500,000 digit integers. The MLflow UI becomes unresponsive for all users within seconds. The SOC sees timeout errors and slow page loads, likely attributing it to a load spike. Meanwhile, ML engineers lose access to experiment comparisons and cannot promote models through the registry—halting a production deployment pipeline. No exploit code required beyond a basic HTTP client.
Weaknesses (CWE)
CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.
- [Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
- [Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References
Timeline
Related Vulnerabilities
CVE-2025-15379 10.0 MLflow: RCE via unsanitized model dependency specs
Same package: mlflow CVE-2023-3765 10.0 MLflow: path traversal allows arbitrary file read
Same package: mlflow CVE-2023-1177 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow CVE-2026-2635 9.8 mlflow: security flaw enables exploitation
Same package: mlflow CVE-2023-2780 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow