Read the docs
TI-2024-02903 Aliases CVE-2024-3099GHSA-8f8q-q2j7-7j2m

Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow

Priority MEDIUM 58CWE-475Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00442 38th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed mlflow (PyPI): 2.11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowmlflow/mlflowup to latest—No fix listedCNA
—mlflow (PyPI)before 2.11.32.11.3Patch availableGHSA-8f8q-q2j7-7j2m
  • mlflow/mlflow VendorMLflow Affected up to latest Fixed in — No fix listed CNA
  • mlflow (PyPI) Vendor— Affected before 2.11.3 Fixed in 2.11.3 Patch available GHSA-8f8q-q2j7-7j2m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mlflow:-:*:*:*:*:*:*:*not specified by NVDVulnerableMLflow
  • cpe:2.3:a:lfprojects:mlflow:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·MLflow

Remediation

  • Fix · GHSA-8f8q-q2j7-7j2m mlflow (PyPI) Fixed in 2.11.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-3099
  2. 2026-10-03 Alias added: GHSA-8f8q-q2j7-7j2m

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-05540 MLflow Authentication Bypass CVSS 3.1CRITICAL 9.8
  • TI-2023-02603 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
See all 76 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences