CVE-2024-3099 json
Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflow
published 2024-06-06 2 y ago modified 2026-07-07 4 mo ago also BIT-mlflow-2024-3099 , EUVD-2024-1979 , GHSA-8f8q-q2j7-7j2m , PYSEC-2026-1645
- cvss
- 5.4
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
A vulnerability in mlflow/mlflow version 2.11.1 allows attackers to create multiple models with the same name by exploiting URL encoding. This flaw can lead to Denial of Service (DoS) as an authenticated user might not be able to use the intended model, as it will open a different model each time. Additionally, an attacker can exploit this vulnerability to perform data model poisoning by creating a model with the same name, potentially causing an authenticated user to become a victim by using the poisoned model. The issue stems from inadequate validation of model names, allowing for the creation of models with URL-encoded names that are treated as distinct from their URL-decoded counterparts.
Patch / fix
- pypi mlflow 2.11.3
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/8d96374a-ce8d-480e-9cb0-0a7e5165c24a referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| GitHub | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| OSV | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
| OSV | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | mlflow | <2.11.3 |
2.11.3 |
| bitnami | mlflow | — | no fix listed |
Affected products
- mlflow mlflow/mlflow
- lfprojects mlflow
Classification
- Weakness
-
- CWE-475 Undefined Behavior for Input to API
References
-
huntr.com
/bounties/8d96374a-ce8d-480e-9cb0-0a7e5165c24a
web, exploit, issue-tracking, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-3099
advisory
-
github.com
/mlflow/mlflow
package
-
pypi.org
/project/mlflow
package
-
github.com
/advisories/GHSA-8f8q-q2j7-7j2m
advisory
Sources
- CVE List CVE-2024-3099
- GitHub Advisory GHSA-8f8q-q2j7-7j2m
- NVD CVE-2024-3099
- OSV BIT-mlflow-2024-3099
- OSV PYSEC-2026-1645
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.