CVE-2026-2033: MLflow Tracking Server RCE Vulnerability

CVE-2026-2033 Overview

CVE-2026-2033 is a directory traversal vulnerability in MLflow Tracking Server that enables remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server without requiring authentication. The specific flaw exists within the handling of artifact file paths, where the lack of proper validation of user-supplied paths prior to using them in file operations creates a dangerous attack surface.

Critical Impact

Unauthenticated remote attackers can leverage this directory traversal flaw to achieve arbitrary code execution in the context of the service account, potentially leading to full system compromise.

Affected Products

• MLflow Tracking Server (vulnerable versions prior to patch)
• MLflow installations with artifact handling enabled
• Systems exposing MLflow Tracking Server to untrusted networks

Discovery Timeline

• 2026-02-20 - CVE CVE-2026-2033 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2033

Vulnerability Analysis

This vulnerability (tracked as ZDI-CAN-26649) stems from improper input validation in the artifact handler component of MLflow Tracking Server. The flaw allows attackers to manipulate file path parameters to traverse directory boundaries, enabling access to files and directories outside the intended artifact storage location. Because no authentication is required to exploit this vulnerability, any network-accessible MLflow Tracking Server instance is potentially at risk.

The attack complexity is considered high due to the specific conditions required for successful exploitation, but when exploited, the impact is severe across all three security dimensions—confidentiality, integrity, and availability are all highly impacted.

Root Cause

The root cause is a classic CWE-22 (Path Traversal) vulnerability where user-supplied path input is not properly sanitized before being used in file system operations. The artifact handler accepts file path parameters that can include directory traversal sequences (such as ../) without adequate validation, allowing attackers to break out of the intended directory structure and access or manipulate arbitrary files on the system.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can craft malicious requests to the artifact handler endpoint containing path traversal sequences in the file path parameter. When processed by the vulnerable MLflow Tracking Server, these sequences allow the attacker to:

1. Navigate outside the designated artifact storage directory
2. Read, write, or execute files in unintended locations
3. Ultimately achieve code execution in the context of the MLflow service account

The vulnerability can be exploited by sending specially crafted HTTP requests to the artifact handling endpoints with manipulated path parameters containing traversal sequences like ../ to escape the artifact root directory. This allows an attacker to write malicious files to executable locations or overwrite critical system files.

Detection Methods for CVE-2026-2033

Indicators of Compromise

• HTTP requests to MLflow artifact endpoints containing path traversal sequences such as ../ or encoded variants (%2e%2e%2f)
• Unexpected file access or modifications outside the MLflow artifact storage directories
• New or modified files in executable paths or system directories created by the MLflow service account
• Unusual process execution spawned by the MLflow Tracking Server process

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block path traversal patterns in requests to MLflow endpoints
• Monitor file system activity for the MLflow service account, alerting on access to directories outside expected artifact paths
• Deploy endpoint detection and response (EDR) solutions to identify suspicious process execution chains originating from the MLflow service
• Analyze HTTP access logs for requests containing encoded or unencoded directory traversal sequences

Monitoring Recommendations

• Enable detailed logging for MLflow Tracking Server artifact operations and review logs for anomalous path patterns
• Configure file integrity monitoring (FIM) on critical system directories to detect unauthorized modifications
• Set up network monitoring to identify reconnaissance or exploitation attempts targeting MLflow endpoints
• Establish baseline behavior for MLflow service account activities and alert on deviations

How to Mitigate CVE-2026-2033

Immediate Actions Required

• Apply the security patch referenced in GitHub Pull Request #19260 immediately
• Restrict network access to MLflow Tracking Server to trusted networks and users only
• Implement authentication and authorization controls in front of MLflow if not already in place
• Review logs for signs of prior exploitation attempts

Patch Information

MLflow has addressed this vulnerability through GitHub Pull Request #19260. Organizations should update to the patched version of MLflow as soon as possible. Additional technical details regarding this vulnerability are available in the Zero Day Initiative Advisory ZDI-26-105.

Workarounds

• Place MLflow Tracking Server behind a reverse proxy with path validation rules that reject requests containing directory traversal sequences
• Restrict the MLflow service account permissions to limit potential damage if exploitation occurs
• Implement network segmentation to isolate MLflow Tracking Server from critical systems
• Use a Web Application Firewall (WAF) to filter malicious requests before they reach the MLflow server

# Example: Nginx configuration to block path traversal attempts
location /api/2.0/mlflow/artifacts {
    # Block requests containing path traversal sequences
    if ($request_uri ~* "\.\.") {
        return 403;
    }
    proxy_pass http://mlflow-backend;
}