CVE-2026-53995

Received Received - Intake

Path Traversal in MLflow FileStore Tracking Backend

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-53995

Affected Vendors & Products

Vendor	Product	Version / Range
mlflow	mlflow	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

MLflow 3.17.1 and earlier has a path traversal vulnerability in the FileStore tracking backend. Unauthenticated attackers can submit a crafted trace ID with traversal sequences to the POST /api/3.0/mlflow/traces endpoint. This allows them to control filesystem paths and write files like trace_info.yaml outside the intended experiment trace directory, subject to the server process's filesystem permissions.

Detection Guidance

Check MLflow server logs for unusual POST requests to /api/3.0/mlflow/traces with suspicious trace IDs containing path traversal sequences like '../'. Monitor for unexpected file writes outside experiment directories, especially trace_info.yaml or metadata files.

Impact Analysis

Attackers could write malicious files to arbitrary locations on the server, potentially leading to remote code execution, data theft, or system compromise. The impact depends on the server's filesystem permissions and the attacker's goals.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. It may result in data breaches, unauthorized disclosures, or compromised audit logs.

Mitigation Strategies

Upgrade MLflow to version 3.17.2 or later. If using FileStore, switch to the default SQLite backend or another secure tracking backend. Restrict network access to the MLflow server and monitor for unauthorized file operations.

Hi! I’m here to help you understand CVE-2026-53995. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70