Exploit for CVE-2024-37054-MLflow-reverse-shell

kitploit · 2026-08-27

Description

Reverse shell vulnerability in MLflow tracked as CVE-2024-37054.

Entry point

Parameterfile · request body

Pathmodels.smarthire.htb/predict

MLflow pickle deserialization (CVE-2024-37054) leads to RCE when a malicious model is loaded during /predict.

Affected Lfprojects Mlflow versions

Lfprojects Mlflow All versions

All known vulnerabilities by product

Mlflow

CVSS 8.8 for CVE-2024-37054

8.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:REQUIRED

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

0.7%higher than 50.3% of all CVEs

Updated 2026-08-29

CVE Information

CVE-2024-37054

Exploit Details

Modified:2026-08-27 00:15

Last Seen:2026-08-27 21:49

Reporter:KitPloit

Other exploits for CVE-2024-37054

CVE-2024-37054

2026-08-28 KitPloitKITPLOIT

CVE-2024-37054-MLflow-RCE

2026-08-28 KitPloitKITPLOIT

CVE-2024-37054

2026-08-27 KitPloitKITPLOIT

CVE-2024-37054-PoC

2026-08-26 KitPloitKITPLOIT

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

2026-07-23 Cosm3No1deGITHUB

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

2026-05-19 tristanqtnGITHUB

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

2026-05-18 jimmexploitGITHUB

Exploit for Deserialization of Untrusted Data in Lfprojects Mlflow

2026-05-17 ben-slatesGITHUB

Exploit Code

MARKDOWN4 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-SPYDOMAIN-CVE-2024-37054-MLFLOW-REVERSE-SHELL
## उपकरण और फ़ाइलें

* * *

Exploit Code

Share

Share on social media: