CVE-2026-53995 · GHSA-wqmh-qccw-pqwf

MLflow FileStore trace IDs allow path traversal and arbitrary file writes

Risk score: 68/100
CVSS: 8.2 v3.1
Exploit chance (30 days): 0.6%
Published: 19 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: MLflow has a path traversal vulnerability in the FileStore tracking backend, allowing unauthenticated attackers to control filesystem paths and write files with attacker-controlled metadata. Attackers can exploit this to write files outside the intended experiment trace directory.
Affected: {'products': ['MLflow'], 'packages': [{'ecosystem': 'pip', 'name': 'mlflow', 'vulnerable': '<= 3.17.1', 'patched': '3.17.2'}]}
Fix: Upgrade to version 3.17.2 or later
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

mlflow: Amber, patch this week. MLflow has a path traversal vulnerability in the FileStore tracking backend, allowing unauthenticated attackers to control filesystem paths and write files with attacker-controlled metadata. Attackers can exploit this to write files outside the intended experiment trace directory.

The flaws

CVE-2026-53995: MLflow FileStore trace IDs allow path traversal and arbitrary file writes (CVSS 8.2 · EPSS 1%)
CVE-2026-115886: MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints (CVSS 6.5 · EPSS 0%)

The fix

Upgrade mlflow: 3.17.0 or later on your release line

Who is exposed: {'products': ['MLflow'], 'packages': [{'ecosystem': 'pip', 'name': 'mlflow', 'vulnerable': '<= 3.17.1', 'patched': '3.17.2'}]}

Where it stands

No known exploitation

Connects to

Same weakness: Path traversal (CWE-22). 399 other warnings in 30 days

Why it is Amber

CVSS 8.2 high
Remotely exploitable without logging in
On your watchlist: PyPI

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
mlflow	pip	<= 3.17.1	3.17.2

References

Original description

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

Last activity 20 Oct 2026. Patch Forecast updates every hour.