CVE-2026-53995: MLflow 3.17.1 and prior Path Traversal via Trace ID API
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.starttrace() to write traceinfo.yaml, requestmetadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed by default?
Deployments using MLflow versions before 3.7.0 are exposed by default because FileStore was the default tracking backend. In later affected versions through 3.17.1, exposure requires FileStore to have been explicitly selected.
What does an attacker need to exploit this issue?
An attacker needs network access to the POST /api/3.0/mlflow/traces endpoint. No authentication or user interaction is required, and exploitation uses a crafted trace ID containing path-traversal sequences.
What can an attacker do on a vulnerable server?
The attacker can cause FileStore to write trace_info.yaml, request metadata, and tag files outside the intended experiment trace directory. The reachable locations and resulting impact are limited by the filesystem permissions of the MLflow server process.
What can be done if patching cannot happen immediately?
Use a tracking backend other than FileStore where possible, since the issue affects the FileStore backend. Restrict unauthenticated network access to the traces API and ensure the MLflow process has only the filesystem permissions it requires.