# CVE-2026-2033: MLflow Tracking Server directory traversal remote code execution

Source: https://junglewise.ai/threats/cve-2026-2033-mlflow-tracking-server-directory-traversal-remote-code-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-20. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-2033 · Severity: high · CVSS 7.3 · Published 2026-02-20

MLflow is an open-source platform used by data scientists to manage the machine learning lifecycle, including tracking experiments and storing models. A security vulnerability in its tracking server allows an unauthenticated attacker to remotely execute commands on the server. This could lead to a total compromise of the machine learning environment, including the theft of proprietary models or sensitive training data.

Technologies: [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow). Vendors: [MLflow](https://junglewise.ai/threats/vendors/mlflow), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-2033 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-2033 being exploited in the wild.

**How severe is CVE-2026-2033?** High severity, with a CVSS score of 7.3, published 20 February 2026.

**Which products and versions are affected?** MLflow Tracking Server 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f; mlflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.8.0rc0.

**Is there a fix for CVE-2026-2033?** Yes. mlflow (PyPI): upgrade to 3.8.0rc0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-2033 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-2033?** Check whether you run MLflow Tracking Server or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mlflow (PyPI): upgrade to 3.8.0rc0 or later

  ```sh
  pip install "mlflow>=3.8.0rc0"
  ```


## Technical details

A directory traversal vulnerability exists in the MLflow Tracking Server's artifact handler due to insufficient validation of user-supplied file paths. By providing a specially crafted path during artifact operations, a remote, unauthenticated attacker can bypass directory restrictions to perform unauthorized file operations. This flaw can be leveraged to achieve remote code execution in the context of the service account running the MLflow server. The vulnerability is tracked as CVE-2026-2033 and was addressed in MLflow pull request 19260 by implementing stricter path validation for local filestore backends.

## Affected products

- MLflow MLflow Tracking Server 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f
- Red Hat Red Hat OpenShift AI (RHOAI)

## Identifiers

- CVE-2026-2033
- GHSA-q2r8-vmq7-fpx2
- PYSEC-2026-2658

## Timeline

- 2025-07-31: disclosed: Vulnerability reported to vendor
- 2025-12-10: patched: Fix merged in MLflow GitHub repository
- 2026-02-13: advisory: ZDI published advisory ZDI-26-105
- 2026-02-20: advisory: CVE-2026-2033 published in NVD

## References

- [https://github.com/mlflow/mlflow/pull/19260](https://github.com/mlflow/mlflow/pull/19260)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-105/](https://www.zerodayinitiative.com/advisories/ZDI-26-105/)
- [https://access.redhat.com/security/cve/CVE-2026-2033](https://access.redhat.com/security/cve/CVE-2026-2033)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2441508](https://bugzilla.redhat.com/show_bug.cgi?id=2441508)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2033.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2033.json)

## Related threats

- [MLflow Tracking Server missing authorization privilege escalation](https://junglewise.ai/threats/cve-2026-118626-mlflow-tracking-server-issues-missing-authorization-privilege)
- [MLflow arbitrary code execution in third-party scorer deserialization](https://junglewise.ai/threats/cve-2026-116692-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow credential leak in CrewAI autolog](https://junglewise.ai/threats/cve-2026-116691-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow path traversal in prompt model version artifact access](https://junglewise.ai/threats/cve-2026-116690-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow unsafe deserialization in scorer endpoints](https://junglewise.ai/threats/cve-2026-115886-mlflow-is-an-open-source-ai-engineering-platform-for-agents)