CVE-2024-3573: Critical Local File Inclusion in MLflow

CVE-2024-3573 is a critical local file inclusion flaw (CVSS 9.3) in MLflow. The is_local_uri function misclassified URIs with empty or file schemes as non-local, letting crafted model version sources bypass checks and read files on the server. The record gives no fixed version. Check the MLflow release notes for the build that includes the fix.

Weakness class: CWE-29, CWE-22.

What's affected

• Product: mlflow/mlflow (Linux Foundation project). The record lists versions as a wildcard.
• Component: the is_local_uri function in mlflow/utils/uri.py, used when validating a model version source.
• Fix: the linked commit, "Fix local uri" (pull request 10651), changes is_local_uri so a remote hostname on a file URI raises an exception. It also removes the MLFLOW_ALLOW_FILE_URI_AS_MODEL_VERSION_SOURCE setting and the check it controlled. The commit page gives no release number.
• Severity: Critical, CVSS 9.3, per the record. The KEV flag is false.
• Fixed version: not confirmed here.

How to check if you're exposed

1. Check the version: run pip show mlflow where the tracking server runs.
2. Find tracking servers reachable from networks you do not fully control. Run ps aux | grep mlflow on hosts and review your deployment manifests.
3. List who can create model versions or registered models through the API.
4. Scan your lock files with the free in-browser dependency scan to find every environment with an older mlflow.

What to do now

1. Upgrade MLflow to a release containing the fix, confirmed from the project release notes.
2. Put the tracking server behind authentication and a private network.
3. Limit permission to register model versions to trusted users and service accounts.
4. Run the server as a low privilege user with a narrow file system view, in a container where possible.
5. Review server logs for model version source values that use file schemes.

Why it matters

The record lists CWE-29, a path traversal variant using backslash style sequences, and CWE-22. The shared lesson is that a validator and the code that later opens the path must agree about what the string means. Here the validation function treated certain URIs as safe because it did not parse them the same way the file layer did.

The effect is a file read on the server, restricted by the record to files within at least two directory levels of the root. That sounds limited, but configuration files, keys and tokens commonly live in such places.

MLflow servers are often built for internal teams and exposed with weak access control. That is the first thing to fix, whatever the version.

Quick check

Sources

• https://github.com/mlflow/mlflow/commit/438a450714a3ca06285eeea34bdc6cf79d7f6cbc
• Gold entry for CVE-2024-3573

Last reviewed: 19 October 2026.