Description
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
Published: 2026-10-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary file write via path traversal
Action: Apply patch
AI Analysis

Impact

MLflow versions up to 3.17.1 contain a path‑traversal flaw in the FileStore tracking backend. A crafted trace ID that includes traversal sequences causes the server to write trace_info.yaml, request_metadata, and tag files outside the intended experiment directory. The vulnerability is tied to CWE‑22 and is named in CVE‑2026‑53995.

Affected Systems

The flare affects mlflow:mlflow releases 3.17.1 and earlier that employ the FileStore tracking backend. Prior to v3.7.0, FileStore was the default, making every installation of that range vulnerable unless a different backend such as SQLite was explicitly configured. From v3.7.0 onward the default changed to SQLite; newer releases are only vulnerable when the user explicitly selects FileStore. Based on the description, it is inferred that the POST /api/3.0/mlflow/traces endpoint is accessible to unauthenticated clients, giving attackers a direct vector to submit the malicious trace ID.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity. Because the flaw operates without authentication and requires only a single HTTP POST request, the attack surface is wide. EPSS is not publicly available, and the vulnerability is not listed in CISA KEV, but the lack of authentication and the ease of exploitation mean a determined adversary can realistically gain arbitrary file write and potentially remote code execution if executable payloads are written to locations read by MLflow or related services.

Generated by OpenCVE AI on October 20, 2026 at 08:54 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MLflow to a release newer than 3.17.1 that removes the FileStore path‑traversal flaw.
  • If upgrading immediately is not feasible, reconfigure the tracking backend to a secure alternative such as SQLite and disable FileStore entirely.
  • Restrict network access to the /api/3.0/mlflow/traces endpoint or enable authentication so that only authorized users can submit trace data.
  • Monitor logs for anomalous trace ID patterns containing directory traversal sequences and alert administrators.

Generated by OpenCVE AI on October 20, 2026 at 08:54 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-wqmh-qccw-pqwf MLflow FileStore trace IDs allow path traversal and arbitrary file writes
History

Mon, 02 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
References

Tue, 27 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Lfprojects
Lfprojects mlflow
CPEs cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*
Vendors & Products Lfprojects
Lfprojects mlflow

Tue, 20 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Title MLflow 3.17.1 Path Traversal via Trace ID API MLflow 3.17.1 and prior Path Traversal via Trace ID API

Tue, 20 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Mon, 19 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Mlflow
Mlflow mlflow
Vendors & Products Mlflow
Mlflow mlflow

Mon, 19 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
Title MLflow 3.17.1 Path Traversal via Trace ID API
Weaknesses CWE-22
References
Metrics cvssV3_1

{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'}

cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Lfprojects Mlflow
Mlflow Mlflow
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-02T16:11:13.675Z

Reserved: 2026-06-11T16:07:13.001Z

Link: CVE-2026-53995

cve-icon Vulnrichment

Updated: 2026-10-19T21:36:46.787Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-19T22:17:11.013

Modified: 2026-11-02T17:17:44.490

Link: CVE-2026-53995

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-19T21:05:16Z

Links: CVE-2026-53995 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-20T09:00:13Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')