CVE-2026-53995: MLflow Path Traversal Vulnerability

CVE-2026-53995 Overview

CVE-2026-53995 is a path traversal vulnerability [CWE-22] in the MLflow FileStore tracking backend. The flaw affects MLflow versions 3.17.1 and earlier. Unauthenticated attackers can submit a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. This lets them control filesystem paths used by FileStore.start_trace() and write attacker-controlled files outside the intended experiment trace directory.

FileStore was the default tracking backend before MLflow 3.7.0. Deployments on earlier versions are exposed without any special configuration. Later versions default to SQLite and are vulnerable only when FileStore is explicitly selected.

Critical Impact

Unauthenticated remote attackers can write trace_info.yaml, request_metadata, and tag files to arbitrary locations within the MLflow server process's filesystem permissions, enabling integrity compromise and potential downstream code execution.

Affected Products

• MLflow versions up to and including 3.17.1 using the FileStore tracking backend
• MLflow versions prior to 3.7.0 (FileStore is the default backend)
• MLflow 3.7.0 through 3.17.1 when FileStore is explicitly configured

Discovery Timeline

• 2026-10-19 - CVE-2026-53995 published to the National Vulnerability Database (NVD)
• 2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-53995

Vulnerability Analysis

The vulnerability resides in MLflow's FileStore tracking backend, specifically within the trace creation workflow. When a client issues a request to POST /api/3.0/mlflow/traces, the backend invokes FileStore.start_trace() to persist trace metadata on disk. The server derives output filesystem paths from the attacker-supplied trace identifier without sanitizing directory traversal sequences such as ../.

As a result, the server writes trace_info.yaml, request_metadata, and tag files to arbitrary locations reachable by the MLflow process. The endpoint requires no authentication, so any network-reachable attacker can trigger file creation. Written content includes attacker-controlled metadata, which can be used to overwrite or plant configuration files, poison machine-learning experiment artifacts, or stage files that are later executed by other services sharing the host.

Root Cause

The root cause is missing input validation on the trace ID parameter before it is concatenated into a filesystem path. The FileStore backend trusts the client-supplied identifier and uses it as a directory component. Without canonicalization or rejection of .. sequences, path resolution escapes the experiment trace directory. This is a classic path traversal weakness categorized under CWE-22.

Attack Vector

Exploitation requires only network access to the MLflow tracking server. An attacker sends a single HTTP POST request to /api/3.0/mlflow/traces with a trace ID containing traversal sequences. The server then creates files in the targeted directory, constrained only by the process's filesystem permissions. No authentication, user interaction, or privileges are required.

A proof-of-concept and additional technical write-up are available from the VulnCheck Security Advisory and the GitHub PoC Repository. The upstream fix is tracked in the MLflow Pull Request #26842.

Detection Methods for CVE-2026-53995

Indicators of Compromise

• Unexpected trace_info.yaml, request_metadata, or tag files appearing outside the configured experiment trace directory on MLflow hosts.
• HTTP POST requests to /api/3.0/mlflow/traces containing ../, ..%2f, or URL-encoded traversal sequences in the trace ID field.
• MLflow server process writing to filesystem paths outside its tracking directory root.
• New or modified files owned by the MLflow service account in sensitive directories such as /etc, user home directories, or web roots.

Detection Strategies

• Inspect reverse-proxy and MLflow access logs for POST requests to /api/3.0/mlflow/traces whose JSON body contains traversal characters.
• Deploy filesystem integrity monitoring on MLflow hosts to flag writes outside the tracking backend root.
• Correlate anomalous child process creation or configuration file modification with recent MLflow API activity.

Monitoring Recommendations

• Centralize MLflow access logs and alert on trace ID values containing .., backslashes, or encoded path separators.
• Monitor the MLflow service account for file writes to directories outside the tracking root using auditd, Falco, or equivalent host telemetry.
• Track upstream MLflow releases and advisories for backported fixes referencing MLflow Pull Request #26842.

How to Mitigate CVE-2026-53995

Immediate Actions Required

• Upgrade MLflow to the fixed release that incorporates Pull Request #26842 as soon as it is available for your deployment channel.
• Restrict network access to the MLflow tracking server so only trusted clients can reach /api/3.0/mlflow/traces.
• Run the MLflow server as a dedicated low-privilege user with filesystem permissions limited to the tracking directory.
• Audit MLflow hosts for files written outside the configured tracking root since the server was deployed.

Patch Information

The fix is tracked in MLflow Pull Request #26842, which adds validation for the trace ID parameter in the FileStore backend. Administrators should upgrade to the first MLflow release that includes this patch. Refer to the VulnCheck Security Advisory for version mapping and additional guidance.

Workarounds

• Switch the tracking backend from FileStore to the SQLite or a database-backed store, which is the default from MLflow 3.7.0 onward and is not affected by this traversal path.
• Place MLflow behind an authenticating reverse proxy and block requests whose JSON body or path contains .. sequences.
• Apply strict filesystem ACLs so the MLflow process cannot write outside its tracking root even if a traversal payload reaches the backend.

# Example: launch MLflow with a SQLite backend instead of FileStore
mlflow server \
  --backend-store-uri sqlite:///mlflow.db \
  --default-artifact-root /var/lib/mlflow/artifacts \
  --host 127.0.0.1 \
  --port 5000