CVE-2026-53995 MLflow < 3.18.0 Path Traversal via Trace ID API
HighCVSS 8.8
EPSS 0.63%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
MLflow before 3.18.0 contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi mlflow(PyPI) | < 3.17.2 | 3.17.2 |
| pypi mlflow(PyPI) | = 0.0.1 | No fix listed |
| pypi mlflow(PyPI) | = 0.1.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.2.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.2.1 | No fix listed |
| pypi mlflow(PyPI) | = 0.3.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.4.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.4.1 | No fix listed |
| pypi mlflow(PyPI) | = 0.4.2 | No fix listed |
| pypi mlflow(PyPI) | = 0.5.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.5.1 | No fix listed |
| pypi mlflow(PyPI) | = 0.5.2 | No fix listed |
| pypi mlflow(PyPI) | = 0.6.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.7.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.8.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.8.1 | No fix listed |
| pypi mlflow(PyPI) | = 0.8.2 | No fix listed |
| pypi mlflow(PyPI) | = 0.9.0 | No fix listed |
| pypi mlflow(PyPI) | = 0.9.0.1 | No fix listed |
| pypi mlflow(PyPI) | = 0.9.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.0.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.1.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.1.1.dev0 | No fix listed |
| pypi mlflow(PyPI) | = 1.10.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.11.0 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi mlflow(PyPI) | = 1.12.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.12.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.13 | No fix listed |
| pypi mlflow(PyPI) | = 1.13.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.14.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.14.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.15.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.16.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.17.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.18.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.19.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.2.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.20.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.20.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.20.2 | No fix listed |
| pypi mlflow(PyPI) | = 1.21.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.22.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.23.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.23.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.24.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.25.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.25.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.26.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.26.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.27.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.28.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.29.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.3.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.30.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.30.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.4.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.5.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.6.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.7.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.7.1 | No fix listed |
| pypi mlflow(PyPI) | = 1.7.2 | No fix listed |
| pypi mlflow(PyPI) | = 1.8.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.9.0 | No fix listed |
| pypi mlflow(PyPI) | = 1.9.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.0.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.0.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.0.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.1.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.1.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.10.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.10.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.10.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.11.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.11.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.11.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.11.3 | No fix listed |
| pypi mlflow(PyPI) | = 2.11.4 | No fix listed |
| pypi mlflow(PyPI) | = 2.11.5 | No fix listed |
| pypi mlflow(PyPI) | = 2.12.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.12.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.12.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.13.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.13.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.13.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.13.3 | No fix listed |
| pypi mlflow(PyPI) | = 2.14.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.14.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.14.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.14.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.14.2.dev0 | No fix listed |
| pypi mlflow(PyPI) | = 2.14.3 | No fix listed |
| pypi mlflow(PyPI) | = 2.15.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.15.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.15.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.16.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.16.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.16.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.17.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.17.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.17.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.17.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.18.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.18.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.19.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.19.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.2.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.2.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.2.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.20.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.20.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.20.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.20.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.20.3 | No fix listed |
| pypi mlflow(PyPI) | = 2.20.4 | No fix listed |
| pypi mlflow(PyPI) | = 2.21.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.21.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.21.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.21.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.21.3 | No fix listed |
| pypi mlflow(PyPI) | = 2.22.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.22.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 2.22.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.22.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.22.3 | No fix listed |
| pypi mlflow(PyPI) | = 2.22.4 | No fix listed |
| pypi mlflow(PyPI) | = 2.22.5 | No fix listed |
| pypi mlflow(PyPI) | = 2.3.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.3.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.3.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.4.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.4.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.4.2 | No fix listed |
| pypi mlflow(PyPI) | = 2.5.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.6.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.7.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.7.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.8.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.8.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.9.0 | No fix listed |
| pypi mlflow(PyPI) | = 2.9.1 | No fix listed |
| pypi mlflow(PyPI) | = 2.9.2 | No fix listed |
| pypi mlflow(PyPI) | = 3.0.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.0.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.0.0rc1 | No fix listed |
| pypi mlflow(PyPI) | = 3.0.0rc2 | No fix listed |
| pypi mlflow(PyPI) | = 3.0.0rc3 | No fix listed |
| pypi mlflow(PyPI) | = 3.0.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.1.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.1.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.1.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.1.2 | No fix listed |
| pypi mlflow(PyPI) | = 3.1.3 | No fix listed |
| pypi mlflow(PyPI) | = 3.1.4 | No fix listed |
| pypi mlflow(PyPI) | = 3.10.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.10.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.10.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.11.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.11.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.11.0rc1 | No fix listed |
| pypi mlflow(PyPI) | = 3.11.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.12.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.12.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.13.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.13.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.14.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.15.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.15.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.15.2 | No fix listed |
| pypi mlflow(PyPI) | = 3.16.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.16.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.17.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.17.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.2.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.2.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.3.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.3.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.3.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.3.2 | No fix listed |
| pypi mlflow(PyPI) | = 3.4.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.4.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.5.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.5.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.5.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.6.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.6.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.7.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.7.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.8.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.8.0rc0 | No fix listed |
| pypi mlflow(PyPI) | = 3.8.1 | No fix listed |
| pypi mlflow(PyPI) | = 3.9.0 | No fix listed |
| pypi mlflow(PyPI) | = 3.9.0rc0 | No fix listed |
| redhat/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-th-torch-cpu-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
| redhat/rhoai/odh-th-torch-cuda-py312-rhel9(Red Hat:openshift_ai) | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com
- Pull Request issue-tracking patch
- github.com patch
- Researcher Disclosure exploit technical-description
- github.com
- VulnCheck Advisory: MLflow 3.17.1 Path Traversal via Trace ID API third-party-advisory
- Red Hat CVE page mitigation vendor-advisory
- Red Hat Bugzilla 2555862 issue-tracking
- www.cve.org
- Patch Commit issue-tracking patch
- github.com
- Release Notes release-notes