CVE-2024-1558 is a high severity (CVSS 7.5) path traversal in the _create_model_version() function in MLflow's server handlers. A crafted source parameter can bypass validation and allow arbitrary file reads through the model version artifact endpoint. The record names no fixed version, so upgrade past 2.9.2.
What's affected
The record places the flaw in the _create_model_version() function in server/handlers.py, and it exposes files through the /model-versions/get-artifact handler. The reference is a huntr report, which I did not retrieve, and the record gives no fixed version.
MLflow 2.9.2 is named for sibling issues filed the same day, so treat that and earlier as the range to move away from. Check the MLflow release notes to find the first release that addresses it. Related records are CVE-2024-1483, CVE-2024-1560, CVE-2024-1593 and CVE-2024-1594.
How to check if you're exposed
Read the installed version wherever MLflow runs:
pip show mlflow
Check notebooks, training containers and the tracking server. Then ask who can send HTTP requests to the server. If the server has no authentication layer, treat every network client as able to call the model version endpoints.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find all MLflow servers and record their versions.
- Upgrade to a release that the MLflow release notes show addresses the path validation issue.
- Place the server behind authentication and an IP allow list.
- Run it under an account with narrow file system permissions.
- Review the model registry for model versions with unexpected source values.
Why it matters
The record classes this as CWE-22, path traversal. The validation check looked at the source value in one form, but later code used the original value in another form, so URL encoded characters slipped past the check and changed the final path.
Checking one representation and using another is a common cause of traversal bugs. Anything the server account can read is then open to the requester. The record's KEV flag is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What does the attacker get?
Arbitrary file read on the server, in the context of the server process.
Is there a fixed version in the record?
No. Check the MLflow release notes.
Sources
- huntr report (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1558
Last reviewed: 19 October 2026.
