CVE-2026-53995: MLflow: path traversal allows arbitrary file write

Q: Is CVE-2026-53995 actively exploited?

No confirmed active exploitation of CVE-2026-53995 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-53995?

1) Upgrade to a MLflow release containing the fix from PR #26842 once available; track the VulnCheck advisory and upstream releases. 2) Migrate the tracking backend from FileStore to a SQL database (SQLite, PostgreSQL or MySQL); this is the default from 3.7.0. 3) Do not expose the tracking server to the internet; restrict access with network segmentation, a reverse proxy with authentication, or MLflow's built-in authentication. 4) Block or filter requests to /api/3.0/mlflow/traces whose trace ID contains '..', '/', '\' or URL-encoded equivalents at the WAF or proxy. 5) Run the MLflow server as a low-privilege user with a read-only filesystem except for the designated store directory, preferably in a container. 6) Detect: review web and access logs for POST /api/3.0/mlflow/traces with traversal sequences, and look for unexpected trace_info.yaml or tag files outside the experiment directories using file integrity monitoring.

Q: What systems are affected by CVE-2026-53995?

This vulnerability affects the following AI/ML architecture patterns: MLOps experiment tracking, Training pipelines, Model registry and lineage, Shared ML platform servers.

Q: What is the CVSS score for CVE-2026-53995?

CVE-2026-53995 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.60%.

GHSA-wqmh-qccw-pqwfHIGHCISA: TRACK*

Published October 19, 2026

CISO Take

MLflow 3.17.1 and earlier has a path traversal flaw in the FileStore tracking backend: an unauthenticated attacker can send a crafted trace ID to POST /api/3.0/mlflow/traces and make the server write trace metadata files outside the intended experiment directory. The CVSS score is 8.2 (High), driven by network exposure with no authentication and a high integrity impact. EPSS is low (0.56%, roughly the 54th percentile), the CVE is not in CISA KEV, and no Nuclei template exists. A public GitHub repository is linked as an exploit reference, so weaponization is likely to be easy. Blast radius is significant: mlflow has 698 downstream dependents, 85 other CVEs, and an OpenSSF Scorecard of 5.4/10. Exposure depends on configuration. FileStore was the default before 3.7.0 and is opt-in afterward. Identify MLflow servers that use FileStore and are reachable from untrusted networks. Apply the fix from upstream PR #26842 once released, or move to a SQL-backed tracking store and put authentication in front of the tracking server in the meantime.

Sources:NVDEPSSOpenSSFATLASvulncheck.comGitHub

What is the risk?

High. The attack is network-reachable, needs no privileges or user interaction, and has low complexity, so any exposed MLflow tracking server running FileStore is trivially reachable. Impact is high integrity (attacker-controlled files written outside the trace directory, within the server process's permissions) and low availability. Confidentiality is not directly affected. Exploitation probability is currently modest (EPSS 0.56%, not in KEV, no scanner template), but a public proof-of-concept repository lowers the barrier. Many MLflow deployments run without authentication on internal networks, which raises real-world exposure. Deployments on 3.7.0 or later that use the default SQLite backend are not affected.

How does the attack unfold?

Initial Access

Attacker locates an exposed MLflow tracking server using FileStore, with no authentication in front of it.

AML.T0049

Exploitation

Attacker POSTs to /api/3.0/mlflow/traces with a trace ID containing traversal sequences, so start_trace() resolves a path outside the trace directory.

Arbitrary File Write

The server writes trace_info.yaml, request metadata and tag files with attacker-controlled content to the chosen location, within process permissions.

Impact

Experiment and trace data is corrupted or planted files interfere with other pipeline components, reducing integrity and availability of the ML platform.

AML.T0031

Initial Access

Attacker locates an exposed MLflow tracking server using FileStore, with no authentication in front of it.

AML.T0049

Exploitation

Attacker POSTs to /api/3.0/mlflow/traces with a trace ID containing traversal sequences, so start_trace() resolves a path outside the trace directory.

Arbitrary File Write

The server writes trace_info.yaml, request metadata and tag files with attacker-controlled content to the chosen location, within process permissions.

Impact

Experiment and trace data is corrupted or planted files interfere with other pipeline components, reducing integrity and availability of the ML platform.

AML.T0031

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
MLflow	pip	<= 3.17.1	`3.17.2`
28.5KOpenSSF 5.5693 dependentsPushed 6d ago38% patched~68d to patchFull package profile →

Do you use MLflow? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

IHigh

ALow

What should I do?

1 step

1) Upgrade to a MLflow release containing the fix from PR #26842 once available; track the VulnCheck advisory and upstream releases. 2) Migrate the tracking backend from FileStore to a SQL database (SQLite, PostgreSQL or MySQL); this is the default from 3.7.0. 3) Do not expose the tracking server to the internet; restrict access with network segmentation, a reverse proxy with authentication, or MLflow's built-in authentication. 4) Block or filter requests to /api/3.0/mlflow/traces whose trace ID contains '..', '/', '\' or URL-encoded equivalents at the WAF or proxy. 5) Run the MLflow server as a low-privilege user with a read-only filesystem except for the designated store directory, preferably in a container. 6) Detect: review web and access logs for POST /api/3.0/mlflow/traces with traversal sequences, and look for unexpected trace_info.yaml or tag files outside the experiment directories using file integrity monitoring.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableYes

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassSupply ChainFrameworkAPIAML.T0031- Erode AI Model Integrity AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-53995?

Is CVE-2026-53995 actively exploited?

No confirmed active exploitation of CVE-2026-53995 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-53995?

1) Upgrade to a MLflow release containing the fix from PR #26842 once available; track the VulnCheck advisory and upstream releases. 2) Migrate the tracking backend from FileStore to a SQL database (SQLite, PostgreSQL or MySQL); this is the default from 3.7.0. 3) Do not expose the tracking server to the internet; restrict access with network segmentation, a reverse proxy with authentication, or MLflow's built-in authentication. 4) Block or filter requests to /api/3.0/mlflow/traces whose trace ID contains '..', '/', '\' or URL-encoded equivalents at the WAF or proxy. 5) Run the MLflow server as a low-privilege user with a read-only filesystem except for the designated store directory, preferably in a container. 6) Detect: review web and access logs for POST /api/3.0/mlflow/traces with traversal sequences, and look for unexpected trace_info.yaml or tag files outside the experiment directories using file integrity monitoring.

What systems are affected by CVE-2026-53995?

This vulnerability affects the following AI/ML architecture patterns: MLOps experiment tracking, Training pipelines, Model registry and lineage, Shared ML platform servers.

What is the CVSS score for CVE-2026-53995?

CVE-2026-53995 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.60%.

What is the AI security impact?

Affected AI Architectures

MLOps experiment trackingTraining pipelinesModel registry and lineageShared ML platform servers

MITRE ATLAS Techniques

AML.T0031Erode AI Model Integrity

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

Exploitation Scenario

An attacker finds an MLflow tracking server reachable from the network (for example through an exposed internal port or a misconfigured ingress) running a pre-3.7.0 version with the default FileStore. They send POST /api/3.0/mlflow/traces with a trace ID such as '../../../../target/dir'. FileStore.start_trace() resolves the path outside the experiment trace directory and writes trace_info.yaml, request metadata and tag files with attacker-chosen values into a directory the process can write to. The attacker uses this to overwrite or plant YAML-formatted metadata in locations consumed by other pipeline components, corrupt experiment lineage, or disrupt the service, which erodes trust in the tracked experiments and model provenance.

Weaknesses (CWE)

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Primary CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.