CVE-2026-127202: MLflow path traversal in FileStore log outputs API

CVE-2026-127202 · Severity: medium · CVSS 5.3 · Published 2026-11-12

MLflow is an open-source platform for managing machine learning workflows and artifacts. When using the FileStore backend, unauthenticated attackers can exploit a path traversal flaw in the log outputs API to write files to arbitrary locations on the server's filesystem. This could allow an attacker to overwrite critical files or plant malicious content, potentially compromising the server and any dependent ML systems.

Technologies: Mlflow. Vendors: MLflow.

Quick answers

Is CVE-2026-127202 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-127202 being exploited in the wild.
How severe is CVE-2026-127202?
Medium severity, with a CVSS score of 5.3, published 12 November 2026.
Which products and versions are affected?
Mlflow before 3.18.0.
Is there a fix for CVE-2026-127202?
Yes: fixed in 3.18.0. Until then: Disable FileStore if not required, or restrict network access to the MLflow tracking server to trusted sources only. FileStore is opt-in via MLFLOW_ALLOW_FILE_STORE after version 3.7.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-127202 attacked?
It is attacked over the network.
Am I affected by CVE-2026-127202?
Check whether you run Mlflow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 3.18.0

Disable FileStore if not required, or restrict network access to the MLflow tracking server to trusted sources only. FileStore is opt-in via MLFLOW_ALLOW_FILE_STORE after version 3.7.0.

Technical details

The FileStore backend fails to validate the model_id parameter in the POST /api/3.0/mlflow/runs/outputs endpoint, allowing path traversal sequences like ../ to escape the intended run directory. An unauthenticated attacker can supply a malicious model_id to create directories and write meta.yaml files at arbitrary filesystem locations limited only by the server process's file permissions. Input validation was added to reject model IDs that are not single path components.

Affected products

  • MLflow MLflow before 3.18.0

Timeline

  • 2026-11-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.