CVE-2026-53995 MLflow 3.17.1 and prior Path Traversal via Trace ID API
Unauthenticated attackers can write arbitrary files outside the intended directory via crafted trace IDs in MLflow's FileStore backend.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53995?
CVE-2026-53995 is a high-severity path traversal vulnerability in mlflow, published on 19 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
Weakness: CWE-22
Which versions are affected by CVE-2026-53995?
3 open source packages ship an affected version, including mlflow.
| Package | Affected | Fixed in |
|---|---|---|
mlflow Bitnami | All versions to 3.17.2 | None |
mlflow PyPI | All versions | 3.17.2 |
mlflow PyPI | All versions | 3.17.2 |
How do I fix CVE-2026-53995?
Upgrade mlflow to 3.17.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-53995 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-53995 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as BIT-mlflow-2026-53995, GHSA-wqmh-qccw-pqwf.