Cloudanix VulnDB

CVE-2026-53995

High · 8.2

CVSS

8.2

EPSS

0.6%

Published

Oct 19, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in an open-source machine learning tracking system lets outsiders write files anywhere on the server, which could let them tamper with experiment records or other data.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
Application
Class
Path Traversal
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unauthenticated path traversal in the FileStore tracking backend allows control of filesystem paths via crafted trace IDs submitted to POST /api/3.0/mlflow/traces, enabling FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files containing attacker-controlled metadata outside the intended experiment trace directory.

Why it matters to the business

Attackers can modify or corrupt files on the server filesystem, risking data integrity, unauthorized changes to tracking metadata, and potential disruption of ML experiment records in deployments still using the FileStore backend.

How an attack unfolds

An unauthenticated attacker submits a crafted trace ID containing directory traversal sequences to the traces API endpoint; the vulnerable FileStore backend writes attacker-supplied metadata files to arbitrary locations on the filesystem subject to the MLflow process permissions.

How to fix it

Upgrade MLflow to a version newer than 3.17.1 or switch from the FileStore backend to the default SQLite database backend; restrict network access to the traces API until the upgrade is complete.

How to confirm the fix worked

Confirm the FileStore backend is disabled or that the server rejects requests containing traversal sequences in trace IDs; review server configuration and test the traces endpoint with malicious IDs.

Typical attack path

  1. Locate an MLflow server still configured to use the FileStore tracking backend
  2. Craft a trace ID containing path traversal sequences such as ../
  3. Issue an unauthenticated POST request to /api/3.0/mlflow/traces
  4. Cause the server to write trace_info.yaml, request_metadata, or tag files outside the intended directory

How to detect it

Inspect web server and MLflow access logs for POST requests to /api/3.0/mlflow/traces containing suspicious trace IDs with traversal sequences; search filesystem for unexpected trace_info.yaml, request_metadata, or tag files outside normal experiment directories.

  • /api/3.0/mlflow/traces
  • trace_info.yaml
  • request_metadata
  • ../
  • ..\

What your security team should do

  • Immediately upgrade MLflow or migrate away from the FileStore backend
  • Restrict external access to the /api/3.0/mlflow/traces endpoint
  • Audit logs for any prior traversal attempts in trace IDs
  • Monitor EPSS and threat intelligence for emerging exploitation activity

The record

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities