CVE-2026-53995: MLflow FileStore path traversal in trace storage

CVE-2026-53995 · Severity: high · CVSS 8.2 · Published 2026-10-19

MLflow is a machine learning platform that tracks experiments and traces using a file-based storage system. An unauthenticated attacker can exploit a path traversal flaw in the tracing API to write trace files outside their intended directory, potentially corrupting the filesystem or interfering with other stored data on the server.

Technologies: mlflow (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-53995 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-53995 being exploited in the wild.
How severe is CVE-2026-53995?
High severity, with a CVSS score of 8.2, published 19 October 2026.
Which products and versions are affected?
Databricks MLflow 3.17.1 and earlier when using FileStore tracking backend; mlflow (PyPI) <= 3.17.1, ECOSYSTEM:introduced=0,fixed=3.17.2.
Is there a fix for CVE-2026-53995?
Yes. mlflow (PyPI): upgrade to 3.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-53995 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-53995?
Check whether you run Databricks MLflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • mlflow (PyPI): upgrade to 3.17.2 or later
    pip install "mlflow>=3.17.2"

Technical details

The vulnerability exists in MLflow's FileStore tracking backend, where the POST /api/3.0/mlflow/traces endpoint accepts a client-controlled trace_id that is used directly in filesystem path construction without validation. An attacker can craft a trace ID containing path traversal sequences (e.g., ../../../escaped-trace-dir) to escape the intended experiment trace directory and write trace_info.yaml, request_metadata, and tag files to arbitrary locations subject to the server process's permissions. The FileStore backend is the default in MLflow versions before 3.7.0; later versions use SQLite by default but remain vulnerable when FileStore is explicitly configured.

Affected products

  • Databricks MLflow 3.17.1 and earlier when using FileStore tracking backend

Identifiers

  • CVE-2026-53995
  • GHSA-wqmh-qccw-pqwf

Timeline

  • 2026-10-19: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.