MLflow: Path traversal via trace ID in FileStore backend
Summary
MLflow 3.17.1 and earlier contain a path traversal flaw in the FileStore tracking backend. An unauthenticated attacker who can reach the POST /api/3.0/mlflow/traces endpoint can submit a crafted trace ID with traversal sequences, which makes the server write trace_info.yaml, metadata and tag files outside the experiment trace directory. The write is limited by the server process's filesystem permissions, and the public PoC demonstrates integrity impact only, not code execution. The issue applies by default before MLflow 3.7.0 and only when FileStore is explicitly selected from 3.7.0 onward. NVD analysis was still pending at the time of the research notes; the CVSS 4.0 score of 8.8 comes from the CVE record.
Affected
- MLflow 3.17.1 and earlier
- Relevant only with the FileStore tracking backend: default before 3.7.0, opt-in from 3.7.0 onward (the default changed to SQLite)
- Fixes in other maintained branches: Unknown.
Fixed in
- MLflow 3.17.2 (upstream fix in PR #26842, release tag v3.17.2)
- Upgrading only the Python client does not protect a vulnerable tracking server.
Workaround
- No vendor workaround documented. Unknown.
- Restrict network access to the tracking server to trusted hosts.
- Run the tracking server under a least-privileged service account.
- Check whether FileStore is in use.
Exploitation
- A public proof-of-concept repository exists; its content was not reviewed for this entry.
- CISA SSVC: Exploitation: poc, Automatable: yes, Technical Impact: partial.
- Not listed as known exploited (CISA KEV) according to the sources reviewed. No exploitation in the wild known.
Our recommendation
- Upgrade MLflow tracking servers to 3.17.2 or later.
- Until the upgrade is done, limit access to the tracking server to trusted networks and require authentication at the network edge.
- Verify which tracking backend is in use; FileStore deployments are the affected ones.
- Review the directories around the trace storage for unexpected files and metadata.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal
Research sources
- CVE-2026-53995 MLflow path traversal PoC repository github.com
- Upstream fix: MLflow PR #26842 github.com
- VulnCheck advisory: MLflow path traversal via trace ID API www.vulncheck.com
- OSV entry BIT-mlflow-2026-53995 osv.dev
- GitHub Security Advisory GHSA-wqmh-qccw-pqwf github.com
- CVE record summary (threatint) cve.threatint.com
- Downstream report of fix in MLflow 3.17.2 github.com
- Aggregator: KEV and exploitation status (HOL Guard) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 15:43.
Original description (NVD)
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.