Skip to content
fr Sign in
5.3 Medium

CVE-2024-6838 In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a…

Description

In mlflow/mlflow version v2.13.2, a vulnerability exists that allows the creation or renaming of an experiment with a large number of integers in its name due to the lack of a limit on the experiment name. This can cause the MLflow UI panel to become unresponsive, leading to a potential denial of service. Additionally, there is no character limit in the `artifact_location` parameter while creating the experiment.

Affected products and versions

Product Affected versions Fixed in
mlflow/mlflow Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of mlflow/mlflow

The 55 CVEs of mlflow/mlflow →
CVE-2026-8147 In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper… 8.1 High CVE-2026-4035 A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI… 9.1 Critical CVE-2026-3198 MLflow 3.9.0 with basic-auth (`--app-name basic-auth`) fails to enforce authorization checks for multiple Gateway API… 6.5 Medium CVE-2026-2651 A vulnerability in MLflow… 9.0 Critical
Track this CVE