CVE-2024-1594 is a high severity (CVSS 7.5) path traversal in MLflow. A fragment marker in the artifact location URI used when creating an experiment lets an attacker read arbitrary files on the server in the context of the server process. The record names no fixed version, so upgrade past 2.9.2.
What's affected
The record places the flaw in the handling of the artifact_location parameter when an experiment is created, and says it is similar to CVE-2023-6909 but uses a different URI component. It gives no version range or fixed release.
The reference is a huntr report that I did not retrieve. Sibling MLflow records from the same day name 2.9.2, so treat that version and earlier as the range to move away from, and check the project release notes for the fix.
How to check if you're exposed
Read the version:
pip show mlflow
Then list experiments in your tracking server and look at their artifact locations. An unexpected local path or one that contains a fragment marker is worth investigating. Check who can create experiments, since the flaw is in that step.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Inventory MLflow versions across servers, notebooks and containers.
- Upgrade past 2.9.2 using the release notes as a guide.
- Require authentication so only trusted users can create experiments.
- Review existing experiments for strange artifact locations.
- Keep secrets out of directories the server account can read.
Why it matters
The record classes this as CWE-22, path traversal. The parser treated part of the URI as a fragment and ignored it, but the file system code acted on the whole string, so the two disagreed about which path was meant.
Mismatches between two parsers are a recurring cause of traversal and request smuggling issues. The impact is file disclosure, which on ML servers can include keys and data. The record's KEV flag is false.
Quick check
Which earlier CVE is it compared to?
CVE-2023-6909, which used another URI component.
Does it need authentication?
The record does not say. Assume an exposed server is reachable.
Sources
- huntr report (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1594
Last reviewed: 19 October 2026.
