{"id":"CVE-2026-53995","kind":"vulnerability","aliases":["CVE-2026-53995","GHSA-wqmh-qccw-pqwf"],"related":[],"title":"MLflow FileStore trace IDs allow path traversal and arbitrary file writes","description":"MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.","summary":"MLflow's FileStore tracking backend does not sanitize trace IDs, so a crafted ID in a POST to /api/3.0/mlflow/traces makes the server write files outside the experiment trace directory. An unauthenticated attacker can plant attacker-controlled YAML and metadata files at paths the server process can write to.","severity":"high","cvss":8.8,"epss":0.00561,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.17.2"],"affected":"<= 3.17.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-22","mlflow","package","python","self-hosted"],"not_affected_if":["auth-required","database-backend","managed-hosting"],"how_to_check":"Check whether the tracking backend is FileStore: look for file:// or a local ./mlruns path in MLFLOW_TRACKING_URI or the server's --backend-store-uri.\nIf the backend is a SQLite or database URI, the FileStore code path is not in use.","fix":"Upgrade mlflow to 3.17.2 or later.\nIf you cannot upgrade, switch the backend store away from FileStore (for example to a SQLite or database URI) or restrict network access to the tracking server.","status":"open","published_at":"2026-10-19T22:17:11+00:00","first_seen_at":"2026-10-23T21:39:59+00:00","triaged_at":"2026-10-23T21:41:15+00:00","updated_at":"2026-10-23T21:57:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T21:41:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade mlflow to 3.17.2 or later.\nIf you cannot upgrade, switch the backend store away from FileStore (for example to a SQLite or database URI) or restrict network access to the tracking server.","reach":"network","impact":"high","summary":"MLflow's FileStore tracking backend does not sanitize trace IDs, so a crafted ID in a POST to /api/3.0/mlflow/traces makes the server write files outside the experiment trace directory. An unauthenticated attacker can plant attacker-controlled YAML and metadata files at paths the server process can write to.","category":"package","who_cares":["mlflow","python","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker writes attacker-controlled files outside trace directory, limited by server permissions.","analyst_note":"","how_to_check":"Check whether the tracking backend is FileStore: look for file:// or a local ./mlruns path in MLFLOW_TRACKING_URI or the server's --backend-store-uri.\nIf the backend is a SQLite or database URI, the FileStore code path is not in use.\nunknown for any exact command beyond that.","needs_analyst":false,"not_affected_if":["managed-hosting","database-backend","auth-required"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000539,"input_tokens":3012,"output_tokens":476,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,21A '-22':25B '-53995':14A,22A '/api/3.0/mlflow/traces':50B,114C '3.17.1':81C '3.7.0':156C 'affect':177C,188C 'allow':5A,95C 'arbitrari':9A 'attack':63B,67B,97C,116C,131C 'attacker-control':66B,130C 'backend':36B,93C,153C 'chang':164C 'configur':183C 'contain':84C,108C 'control':68B,99C,132C 'craft':44B,105C 'cve':12A,20A 'cwe':24B 'databas':168C 'default':151C,163C 'deploy':170C 'directori':60B,139C 'earlier':83C,173C 'endpoint':115C 'experi':58B,137C 'explicit':193C 'exploit':118C 'file':10A,55B,72B,128C 'filestor':2A,34B,91C,148C,191C 'filestore.start':119C 'filesystem':100C,146C 'ghsa':16A 'ghsa-wqmh-qccw-pqwf':15A 'host':31B 'id':4A,41B,45B,107C 'intend':136C 'later':185C 'make':51B 'metadata':71B,125C,133C 'mlflow':1A,23A,26B,32B,80C,155C 'one':186C 'opt':159C 'opt-in':158C 'outsid':56B,134C 'packag':27B 'part':174C 'path':6A,74B,86C,101C 'permiss':147C 'plant':65B 'post':48B,113C 'pqwf':19A 'process':77B,144C 'python':28B 'qccw':18A 'rang':178C 'request':124C 'sanit':39B 'select':194C 'self':30B 'self-host':29B 'sequenc':110C 'server':53B,76B,143C 'special':182C 'sqlite':167C 'subject':140C 'submit':103C 'tag':127C 'thereaft':161C 'trace':3A,40B,59B,106C,120C,138C 'trace_info.yaml':123C 'track':35B,92C,152C 'travers':7A,87C,109C 'unauthent':62B,96C 'vulner':88C,180C 'without':181C 'wqmh':17A 'write':11A,54B,79B,122C 'yaml':69B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wqmh-qccw-pqwf","url":"https://github.com/advisories/GHSA-wqmh-qccw-pqwf","severity":"high","published_at":"2026-10-20T00:31:59+00:00","modified_at":"2026-10-23T21:34:10+00:00","first_seen_at":"2026-10-23T21:39:59+00:00","fetched_at":"2026-10-23T21:39:59+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-53995","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53995","severity":null,"published_at":"2026-10-19T22:17:11+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}