All vulnerabilities
CVE-2026-53995GHSA-wqmh-qccw-pqwf

MLflow FileStore trace IDs allow path traversal and arbitrary file writes

mlflow mlflowpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.8High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 19 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.17.2Fixed versionGitHub
Published19 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 3.17.2mlflow, pipGitHub
  • 3.17.2mlflow, PyPIOSVpip install "mlflow>=3.17.2"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

Text from CVE List

Affected versions 53

  • mlflow, pip<= 3.17.1GitHub
  • mlflowaffected: all versions through 3.17.1CVE List
  • mlflow, PyPIfrom first release, fixed in 3.17.2OSV
  • mlflow, PyPI0.0.1OSV
  • mlflow, PyPI0.1.0OSV
  • mlflow, PyPI0.2.0OSV
  • mlflow, PyPI0.2.1OSV
  • mlflow, PyPI0.3.0OSV
  • mlflow, PyPI0.4.0OSV
  • mlflow, PyPI0.4.1OSV
  • mlflow, PyPI0.4.2OSV
  • mlflow, PyPI0.5.0OSV
  • mlflow, PyPI0.5.1OSV
  • mlflow, PyPI0.5.2OSV
  • mlflow, PyPI0.6.0OSV
  • mlflow, PyPI0.7.0OSV
  • mlflow, PyPI0.8.0OSV
  • mlflow, PyPI0.8.1OSV
  • mlflow, PyPI0.8.2OSV
  • mlflow, PyPI0.9.0OSV
  • mlflow, PyPI0.9.0.1OSV
  • mlflow, PyPI0.9.1OSV
  • mlflow, PyPI1.0.0OSV
  • mlflow, PyPI1.1.0OSV
  • mlflow, PyPI1.1.1.dev0OSV
  • mlflow, PyPI1.10.0OSV
  • mlflow, PyPI1.11.0OSV
  • mlflow, PyPI1.12.0OSV
  • mlflow, PyPI1.12.1OSV
  • mlflow, PyPI1.13OSV
  • mlflow, PyPI1.13.1OSV
  • mlflow, PyPI1.14.0OSV
  • mlflow, PyPI1.14.1OSV
  • mlflow, PyPI1.15.0OSV
  • mlflow, PyPI1.16.0OSV
  • mlflow, PyPI1.17.0OSV
  • mlflow, PyPI1.18.0OSV
  • mlflow, PyPI1.19.0OSV
  • mlflow, PyPI1.2.0OSV
  • mlflow, PyPI1.20.0OSV
  • mlflow, PyPI1.20.1OSV
  • mlflow, PyPI1.20.2OSV
  • mlflow, PyPI1.21.0OSV
  • mlflow, PyPI1.22.0OSV
  • mlflow, PyPI1.23.0OSV
  • mlflow, PyPI1.23.1OSV
  • mlflow, PyPI1.24.0OSV
  • mlflow, PyPI1.25.0OSV
  • mlflow, PyPI1.25.1OSV
  • mlflow, PyPI1.26.0OSV
  • mlflow, PyPI1.26.1OSV
  • mlflow, PyPI1.27.0OSV
  • mlflow, PyPI1.28.0OSV

References 8