CVE-2026-127202: MLflow < 3.18.0 Path Traversal via model_id in log_outputs API
MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious modelid parameter to the log outputs API. Attackers can exploit the unvalidated modelid containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOWALLOWFILESTORE.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
MLflow deployments before 3.18.0 that use the FileStore backend are affected. FileStore was the default backend before 3.7.0; in later versions it must be explicitly enabled through MLFLOW_ALLOW_FILE_STORE.
Does exploitation require authentication or prior access?
No. An unauthenticated remote attacker can send a POST request to /api/3.0/mlflow/runs/outputs with a malicious model_id containing ../ path traversal sequences.
What filesystem impact can an attacker achieve?
An attacker can create directories and write a meta.yaml file outside the intended run directory. The reachable locations are constrained by the permissions of the account running the MLflow server.
What should be prioritized if an immediate upgrade is not possible?
Disable or avoid the FileStore backend where possible, since the issue is specific to FileStore. Restrict unauthenticated network access to the MLflow API, particularly the log outputs endpoint.