Is CVE-2026-2033 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2033 being exploited in the wild.

How severe is CVE-2026-2033?

High severity, with a CVSS score of 7.3, published 20 February 2026.

Which products and versions are affected?

MLflow Tracking Server 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f; mlflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.8.0rc0.

Is there a fix for CVE-2026-2033?

Yes. mlflow (PyPI): upgrade to 3.8.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-2033 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-2033?

Check whether you run MLflow Tracking Server or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2033: MLflow Tracking Server directory traversal remote code execution

CVE-2026-2033 · Severity: high · CVSS 7.3 · Published 2026-02-20

MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including tracking experiments and storing models. A security vulnerability in its tracking server allows an unauthenticated attacker to remotely execute commands on the server. This could lead to a total compromise of the machine learning environment, including the theft of proprietary models or sensitive training data.

Technologies: mlflow (PyPI). Vendors: MLflow, PyPI.

Quick answers

Is CVE-2026-2033 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2033 being exploited in the wild.
How severe is CVE-2026-2033?: High severity, with a CVSS score of 7.3, published 20 February 2026.
Which products and versions are affected?: MLflow Tracking Server 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f; mlflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.8.0rc0.
Is there a fix for CVE-2026-2033?: Yes. mlflow (PyPI): upgrade to 3.8.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-2033 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-2033?: Check whether you run MLflow Tracking Server or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mlflow (PyPI): upgrade to 3.8.0rc0 or later
```
pip install "mlflow>=3.8.0rc0"
```

Technical details

A directory traversal vulnerability exists in the MLflow Tracking Server's artifact handler due to insufficient validation of user-supplied file paths. By providing a specially crafted path during artifact operations, a remote, unauthenticated attacker can bypass directory restrictions to perform unauthorized file operations. This flaw can be leveraged to achieve remote code execution in the context of the service account running the MLflow server. The vulnerability is tracked as CVE-2026-2033 and was addressed in MLflow pull request 19260 by implementing stricter path validation for local filestore backends.

Affected products

MLflow MLflow Tracking Server 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f
Red Hat Red Hat OpenShift AI (RHOAI)

Identifiers

CVE-2026-2033
GHSA-q2r8-vmq7-fpx2
PYSEC-2026-2658

Timeline

2025-07-31: disclosed: Vulnerability reported to vendor
2025-12-10: patched: Fix merged in MLflow GitHub repository
2026-02-13: advisory: ZDI published advisory ZDI-26-105
2026-02-20: advisory: CVE-2026-2033 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.