CVE-2026-127202 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
MLflow before 3.18.0 with the FileStore backend lets an unauthenticated remote attacker supply a crafted model_id to the log outputs API. The attacker can then create directories and write a meta.yaml file at arbitrary locations the server account can reach.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
MLflow servers before 3.18.0 that use the FileStore backend are exposed, and the flaw is reachable without credentials through the log outputs API. Servers on the default database backend or with FileStore disabled through the environment setting are less exposed. Teams running MLflow only locally on a laptop are lower risk, but any shared or network-reachable tracking server should be checked.
Not affected if database-backend, file-store-disabled, managed-hosting
Who cares mlflow, python, self-hosted
mlflow --version or pip show mlflow, and treat anything below 3.18.0 as exposed.3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE.POST /api/3.0/mlflow/runs/outputs.MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attackers can exploit the unvalidated model_id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE.
This page as ·
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
3.18.0 or later.NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.