{"id":"CVE-2026-127202","kind":"vulnerability","aliases":["CVE-2026-127202"],"related":[],"title":"MLflow: unauthenticated path traversal writes files anywhere on the server","description":"MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attackers can exploit the unvalidated model_id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE.","summary":"MLflow before 3.18.0 with the FileStore backend lets an unauthenticated remote attacker supply a crafted model_id to the log outputs API. The attacker can then create directories and write a meta.yaml file at arbitrary locations the server account can reach.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","mlflow","python","self-hosted"],"not_affected_if":["database-backend","file-store-disabled","managed-hosting"],"how_to_check":"- Check the MLflow version with `mlflow --version` or `pip show mlflow`, and treat anything below `3.18.0` as exposed.\n- Check whether FileStore is in use: FileStore was the default before `3.7.0` and is opt-in afterward through `MLFLOW_ALLOW_FILE_STORE`.\n- Check whether the tracking server is reachable from the network, since the endpoint is `POST /api/3.0/mlflow/runs/outputs`.","fix":"- MLflow: move to `3.18.0` or later.","status":"open","published_at":"2026-11-12T17:17:43+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","triaged_at":"2026-11-12T17:40:01+00:00","updated_at":"2026-11-12T17:40:01+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-12T17:40:01Z","model":"claude-haiku-5-5","output":{"fix":"- MLflow: move to `3.18.0` or later.","reach":"internet","title":"MLflow: unauthenticated path traversal writes files anywhere on the server","impact":"high","summary":"MLflow before 3.18.0 with the FileStore backend lets an unauthenticated remote attacker supply a crafted model_id to the log outputs API. The attacker can then create directories and write a meta.yaml file at arbitrary locations the server account can reach.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","python","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"attacker writes files at arbitrary server paths without credentials","analyst_note":"","how_to_check":"- Check the MLflow version with `mlflow --version` or `pip show mlflow`, and treat anything below `3.18.0` as exposed.\n- Check whether FileStore is in use: FileStore was the default before `3.7.0` and is opt-in afterward through `MLFLOW_ALLOW_FILE_STORE`.\n- Check whether the tracking server is reachable from the network, since the endpoint is `POST /api/3.0/mlflow/runs/outputs`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["managed-hosting","database-backend","file-store-disabled"],"who_is_affected":"MLflow servers before 3.18.0 that use the FileStore backend are exposed, and the flaw is reachable without credentials through the log outputs API. Servers on the default database backend or with FileStore disabled through the environment setting are less exposed. Teams running MLflow only locally on a laptop are lower risk, but any shared or network-reachable tracking server should be checked.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000795,"input_tokens":4723,"output_tokens":645,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127202':13A,16A '-2026':12A,15A '/api/3.0/mlflow/runs/outputs':115C '3.18.0':27B,68C '3.7.0':143C 'account':63B,134C 'afterward':149C 'ai':18B 'ai-tool':17B 'allow':79C,152C 'anywher':7A 'api':46B,102C 'arbitrari':59B,126C 'attack':36B,48B,82C,103C 'backend':31B,72C,141C 'contain':73C,110C 'craft':39B 'creat':51B,118C 'cve':11A,14A 'default':140C 'directori':52B,90C,119C 'endpoint':116C 'exploit':105C 'file':6A,57B,85C,124C,153C 'filestor':30B,71C,137C 'filesystem':127C 'host':24B 'id':41B,96C,109C 'intend':88C 'let':32B 'limit':129C 'locat':60B,128C 'log':44B,100C 'malici':94C 'meta.yaml':56B,123C 'mlflow':1A,20B,25B,66C,151C 'model':40B,95C,108C 'opt':147C 'opt-in':146C 'output':45B,101C 'outsid':86C 'paramet':97C 'path':3A,75C 'permiss':136C 'post':114C 'python':21B 'reach':65B 'remot':35B,81C 'run':89C 'self':23B 'self-host':22B 'sequenc':111C 'server':10A,62B,133C 'store':154C 'suppli':37B,92C 'tool':19B 'travers':4A,76C 'unauthent':2A,34B,80C 'unvalid':107C 'use':69C 'via':112C 'vulner':77C 'write':5A,54B,84C,121C","nicknames":[],"mitigations":[],"who_affected":"MLflow servers before 3.18.0 that use the FileStore backend are exposed, and the flaw is reachable without credentials through the log outputs API. Servers on the default database backend or with FileStore disabled through the environment setting are less exposed. Teams running MLflow only locally on a laptop are lower risk, but any shared or network-reachable tracking server should be checked.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","medium","mlflow","python","selfhosted"],"campaign_type":null,"search_a":"'-127202':13A,16A '-2026':12A,15A 'anywher':7A 'cve':11A,14A 'file':6A 'mlflow':1A 'path':3A 'server':10A 'travers':4A 'unauthent':2A 'write':5A","search_b":"'3.18.0':27B 'account':63B 'ai':18B 'ai-tool':17B 'api':46B 'arbitrari':59B 'attack':36B,48B 'backend':31B 'craft':39B 'creat':51B 'directori':52B 'file':57B 'filestor':30B 'host':24B 'id':41B 'let':32B 'locat':60B 'log':44B 'meta.yaml':56B 'mlflow':20B,25B 'model':40B 'output':45B 'python':21B 'reach':65B 'remot':35B 'self':23B 'self-host':22B 'server':62B 'suppli':37B 'tool':19B 'unauthent':34B 'write':54B","search_c":"'/api/3.0/mlflow/runs/outputs':115C '3.18.0':68C '3.7.0':143C 'account':134C 'afterward':149C 'allow':79C,152C 'api':102C 'arbitrari':126C 'attack':82C,103C 'backend':72C,141C 'contain':73C,110C 'creat':118C 'default':140C 'directori':90C,119C 'endpoint':116C 'exploit':105C 'file':85C,124C,153C 'filestor':71C,137C 'filesystem':127C 'id':96C,109C 'intend':88C 'limit':129C 'locat':128C 'log':100C 'malici':94C 'meta.yaml':123C 'mlflow':66C,151C 'model':95C,108C 'opt':147C 'opt-in':146C 'output':101C 'outsid':86C 'paramet':97C 'path':75C 'permiss':136C 'post':114C 'remot':81C 'run':89C 'sequenc':111C 'server':133C 'store':154C 'suppli':92C 'travers':76C 'unauthent':80C 'unvalid':107C 'use':69C 'via':112C 'vulner':77C 'write':84C,121C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127202","severity":null,"published_at":"2026-11-12T17:17:43+00:00","modified_at":"2026-11-12T17:17:43+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","fetched_at":"2026-11-12T17:39:39+00:00","note":null}],"documents":[{"id":136859,"url":"https://github.com/mlflow/mlflow/commit/ab5fc795eedc22348253cf687818cf2a16c15282","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":136860,"url":"https://github.com/mlflow/mlflow/releases/tag/v3.18.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":136861,"url":"https://www.vulncheck.com/advisories/mlflow-path-traversal-via-model-id-in-log-outputs-api","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}