MLflow: MLflow FileStore trace IDs allow path traversal and arbitrary file writes
MLflow
More for MLflow RSS feed for MLflow
- Severity
- High, CVSS 8.2
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
- Record
- CVE-2026-53995
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- October 20, 2026
- Source last modified
- October 23, 2026
Description
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
Description quoted from the NVD record.
Who is affected
MLflow, made by LF Projects, is a platform for tracking and managing machine learning projects. This flaw affects MLflow 3.17.1 and earlier when it stores its tracking data as plain files on the server (the file storage option). Before version 3.7.0 that option is the default, so those versions are affected without special setup. From 3.7.0 on, the default is a database, and only servers where file storage was chosen are affected. Someone with no login could send a crafted web request that writes files with their own content outside the intended folder, limited to what the MLflow server is allowed to write. This flaw is rated High.
What to do
- If you or someone on your staff installed and runs MLflow, that person should handle this. If an IT provider or vendor runs it for your organization, send them this advisory and ask when the update will be done.
- Find out which version of MLflow you run and whether it stores tracking data as plain files on the server. Versions 3.17.1 and earlier are affected, and versions 3.7.0 and later are affected only when file storage was chosen.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release.
- Once a fixed release is available, install it on every MLflow server your organization runs.
Analysis written from the source record as of October 23, 2026 and reviewed before publishing.