CVE-2024-3848 is a high severity path traversal in MLflow version 2.11.0, scored 7.5 by NVD. It bypasses the earlier fix for CVE-2023-6909 and lets an attacker read arbitrary files, such as SSH and cloud keys. Upgrade beyond 2.11.0 and confirm the exact fixed release in the project's commit and advisory.
What's affected
The record names MLflow, from the LF Projects CPE, at version 2.11.0. The description calls the bug a bypass of the earlier fix for CVE-2023-6909, so any deployment that relied on that earlier patch is in scope if it runs 2.11.0.
The record does not state a fixed release number. It links the project's fixing commit and the huntr bounty report. Read the commit and the MLflow release notes to find the first release that contains it, and do not assume that any specific later version is clean without checking.
The description says the flaw is reachable over the network without authentication, which matches the vector. The KEV flag is false and no advisory in the record reports exploitation in the wild.
The NVD record is dated 2024-05-16 and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, a score of 7.5 (High). Weakness class: CWE-29, CWE-22.
How to check if you're exposed
List the MLflow version in each environment where a tracking server or model registry runs.
pip show mlflow
pip freeze | grep -i mlflow
For containers, run the same command inside the image, or scan the image for installed Python packages. Look at every place the tracking server is deployed, including notebooks and shared research clusters where it was installed once and forgotten.
Next, find out who can reach the server. A tracking server open to a wide internal network or the internet is far more exposed than one bound to localhost or placed behind an authenticating proxy. Check the host's access logs for requests to the artifact endpoints that contain unusual URL fragments.
Free dependency scanning needs no account: paste a manifest into the in-browser scan to see which known CVEs apply to the libraries you ship. The Gold directory lists each CVE with its affected packages.
What to do now
- Find every MLflow deployment and record its version.
- Upgrade any 2.11.0 deployment to a release that includes the fixing commit from the record, and verify in the release notes.
- Put the tracking server behind authentication and restrict network access to the teams that need it.
- Rotate SSH keys, cloud credentials and API tokens that were readable by the MLflow service account if the server was reachable by untrusted users.
- Run the service under a dedicated low privilege account with no access to home directories holding keys.
Why it matters
The weakness is path traversal, CWE-22, with a related entry for path equivalence, CWE-29. The server turns an artifact URL into a filesystem path. The description says a hash character can place a path in the URL fragment so that validation is skipped, and then the conversion uses the supplied path. In plain terms, the check looked at one part of the URL and the file access used another.
Bypasses of earlier fixes are common in this class. Patching one trick leaves the root cause, which is trusting a path that came from a request. The lasting answer is to resolve the final path and confirm it sits inside the allowed directory, and to keep the process account unable to read secrets it does not need.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is MLflow 2.11.0 the only affected version?
The record names 2.11.0. It does not list other versions, so check the project's fixing commit and release notes for the full range before assuming other releases are safe.
What can an attacker read?
The description says arbitrary files the server account can read, with SSH and cloud keys given as examples.
Sources
Last reviewed: 19 October 2026.
