Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-53995MLflow 3.17.1 and prior Path Traversal via Trace ID API

High 8.2

In plain English

A high-severity path traversal in mlflow from mlflow. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.6%top 49.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	mlflow	3.17.2	GHSA-wqmh-qccw-pqwf

Affected products (as reported)

Vendor	Product	Versions
mlflow	mlflow	0 – through 3.17.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

References

Researcher Disclosure technical-description, exploit
Pull Request issue-tracking, patch
Patch Commit issue-tracking, patch
VulnCheck Advisory: MLflow 3.17.1 Path Traversal via Trace ID API third-party-advisory