AI Threat Alert
CVE-2024-6838: MLflow: unconstrained input causes UI denial of service
GHSA-q3gw-8236-5jw4 MEDIUM PoC AVAILABLE CISA: TRACK*MLflow v2.13.2 and earlier allow unauthenticated network attackers to crash the UI by submitting experiment names with arbitrarily large integer strings—zero credentials required. If your data science teams run MLflow on accessible networks without an auth proxy, this is exploitable today. Restrict network access immediately, deploy an authentication layer, and plan an upgrade.
Risk Assessment
CVSS 5.3 Medium with EPSS 0.00121—low likelihood of opportunistic exploitation in the wild, but the attack profile (network, no auth, no user interaction, low complexity) makes it trivially executable by any attacker with reachability. The real risk multiplier is organizational: MLflow instances are frequently stood up by data science teams without hardening or network segmentation. Not in CISA KEV. Impact is confined to UI availability; model serving and training jobs are not directly disrupted, but ML operations teams lose experiment visibility and model promotion capability.
Affected Systems
Severity & Risk
Attack Surface
Recommended Action
6 steps-
Upgrade MLflow past v2.13.2 (monitor upstream GitHub releases for patch).
-
If immediate upgrade is blocked, firewall MLflow to trusted internal networks only—no public exposure.
-
Deploy an OAuth2 Proxy or reverse proxy with authentication in front of any MLflow instance; no production tracking server should be unauthenticated.
-
Add WAF or API gateway rules to reject experiment names exceeding 255 characters.
-
Audit existing experiments for anomalous artifact_location values (unexpected URIs, relative paths, internal hostnames).
-
Enable API access logging on MLflow; alert on high-volume experiment creation bursts from single IPs.
CISA SSVC Assessment
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
Classification
Compliance Impact
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2024-6838?
MLflow v2.13.2 and earlier allow unauthenticated network attackers to crash the UI by submitting experiment names with arbitrarily large integer strings—zero credentials required. If your data science teams run MLflow on accessible networks without an auth proxy, this is exploitable today. Restrict network access immediately, deploy an authentication layer, and plan an upgrade.
Is CVE-2024-6838 actively exploited?
Proof-of-concept exploit code is publicly available for CVE-2024-6838, increasing the risk of exploitation.
How to fix CVE-2024-6838?
1. Upgrade MLflow past v2.13.2 (monitor upstream GitHub releases for patch). 2. If immediate upgrade is blocked, firewall MLflow to trusted internal networks only—no public exposure. 3. Deploy an OAuth2 Proxy or reverse proxy with authentication in front of any MLflow instance; no production tracking server should be unauthenticated. 4. Add WAF or API gateway rules to reject experiment names exceeding 255 characters. 5. Audit existing experiments for anomalous artifact_location values (unexpected URIs, relative paths, internal hostnames). 6. Enable API access logging on MLflow; alert on high-volume experiment creation bursts from single IPs.
What systems are affected by CVE-2024-6838?
This vulnerability affects the following AI/ML architecture patterns: MLOps platforms, training pipelines, experiment tracking, model registry.
What is the CVSS score for CVE-2024-6838?
CVE-2024-6838 has a CVSS v3.1 base score of 5.3 (MEDIUM). The EPSS exploitation probability is 0.55%.
Technical Details
NVD Description
In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment.
Exploitation Scenario
An attacker discovers an internet-facing MLflow tracking server—common in data science teams that launch `mlflow ui` without authentication. Using curl or a Python script, they POST to /api/2.0/mlflow/experiments/create with an experiment name field containing 500,000 digit integers. The MLflow UI becomes unresponsive for all users within seconds. The SOC sees timeout errors and slow page loads, likely attributing it to a load spike. Meanwhile, ML engineers lose access to experiment comparisons and cannot promote models through the registry—halting a production deployment pipeline. No exploit code required beyond a basic HTTP client.
Weaknesses (CWE)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L References
Timeline
Related Vulnerabilities
CVE-2025-15379 10.0 MLflow: RCE via unsanitized model dependency specs
Same package: mlflow CVE-2023-3765 10.0 MLflow: path traversal allows arbitrary file read
Same package: mlflow CVE-2023-1177 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow CVE-2026-2635 9.8 mlflow: security flaw enables exploitation
Same package: mlflow CVE-2023-2780 9.8 MLflow: path traversal allows arbitrary file read/write
Same package: mlflow