CVE-2026-53995
8.2HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity
- Weakness
- CWE-22
Impact
Unauthenticated remote attackers can write arbitrary metadata files outside the intended directory with the permissions of the MLflow server process. Attackers only need network access to the POST /api/3.0/mlflow/traces endpoint on instances using the FileStore backend.
Root cause
The FileStore.start_trace() handler fails to sanitize path traversal sequences supplied in the trace ID parameter when generating file paths.
Affected systems
MLflow 3.17.1 and earlier using the FileStore backend (default backend before 3.7.0, opt-in thereafter).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Fix & remediation
Upgrade to a version newer than MLflow 3.17.1. If unable to patch immediately, switch the tracking backend away from FileStore to a database backend like SQLite or SQLAlchemy, or block access to POST /api/3.0/mlflow/traces at your reverse proxy.
$ pip install --upgrade mlflowAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.