CVE-2026-2033

MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26649.

An adversary targeting an organization's AI/ML pipeline scans for exposed MLflow Tracking Server instances on internal networks or via misconfigured cloud security groups. Finding an accessible instance, they craft a POST request to the artifact upload endpoint with a path containing directory traversal sequences (e.g., ../../etc/cron.d/backdoor), bypassing the lack of path validation in the artifact handler. They write a malicious script to a cron directory or overwrite a Python module in the MLflow virtual environment, achieving code execution as the service account on the next scheduled execution. From this foothold, the attacker accesses the full experiment database (exposing proprietary model architectures, hyperparameters, and dataset locations), exfiltrates trained model weights, and potentially injects poisoned artifacts into the model registry — artifacts that may propagate to production inference systems if the pipeline lacks artifact integrity verification.