CVE-2024-3099: mlflow model registry allows duplicate model names through URL encoding

Summary

CVE-2024-3099 affects mlflow/mlflow version 2.11.1. Attackers exploit URL encoding to create multiple models with the same name, because URL-encoded names are treated as distinct from their URL-decoded counterparts. This can cause a denial of service, since an authenticated user may open a different model each time, and it enables data model poisoning, where a user unknowingly loads an attacker-created model.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• LowCloakFEM: Agentic FEM Code Generation for Red-Teaming Computational Resource ExhaustionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumThe Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model ResourcesSimilar attack · Google Threat Intelligence
• InfoSecuring next-generation edge intelligence: A survey from federated learning to autonomous agents in cyber-physical systemsSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoThe Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM InferenceSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPop Goes the Verifier: Phoneme-Targeted Data Poisoning of Voice Liveness DetectionSimilar attack · Arxiv (cs.RO + cs.CV security)