Read the docs
TI-2026-76541 Aliases CVE-2026-53995GHSA-wqmh-qccw-pqwf

Path traversal in MLflow trace ID API lets attackers write files

Priority HIGH 77CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

MLflow 3.17.1 and earlier contains a path traversal flaw (CWE-22) in the FileStore tracking backend. An unauthenticated remote attacker can submit a crafted trace ID to the POST /api/3.0/mlflow/traces endpoint to write files outside the trace directory. FileStore is the default backend before MLflow 3.7.0 and opt-in after that. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00625 50th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Partial mlflow (PyPI): 3.17.2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowmlflowup to 3.17.1—No fix listedCNA
—mlflow (PyPI)before 3.17.23.17.2Patch availableGHSA-wqmh-qccw-pqwf
  • mlflow VendorMLflow Affected up to 3.17.1 Fixed in — No fix listed CNA
  • mlflow (PyPI) Vendor— Affected before 3.17.2 Fixed in 3.17.2 Patch available GHSA-wqmh-qccw-pqwf

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*——MLflow
  • cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:* Versions — — ·MLflow

Remediation

Upgrade the PyPI package mlflow to 3.17.2, which fixes this flaw. The sources list no fixed version for Red Hat OpenShift AI (RHOAI).

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · GHSA-wqmh-qccw-pqwf mlflow (PyPI) Fixed in 3.17.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Not affected: 1 product
  • Red Hat OpenShift AI (RHOAI)

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-53995
  2. 2026-10-20 Alias added: GHSA-wqmh-qccw-pqwf
  3. 2026-10-20 Affected versions changed · Red Hat
  4. 2026-10-20 CVSS score added · Red Hat
  5. 2026-10-20 Title updated · CNA
  6. 2026-10-21 Affected versions changed · Red Hat
  7. 2026-10-23 Fix available: PyPI/[email protected] · GHSA-wqmh-qccw-pqwf
  8. 2026-10-23 CVSS score added · GHSA-wqmh-qccw-pqwf
  9. 2026-10-23 Weakness changed · GHSA-wqmh-qccw-pqwf
  10. 2026-10-23 6 new references · GHSA-wqmh-qccw-pqwf
  11. 2026-11-02 1 new reference · CNA
  12. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Exploit 1

Patch 2

Advisory 1

Other 3

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences