# CVE-2026-53995: MLflow FileStore path traversal in trace storage

Source: https://junglewise.ai/threats/cve-2026-53995-mlflow-3-17-1-and-earlier-contains-a-path-traversal-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-19. Updated: 2026-10-19  
License: CC BY 4.0 with a link back

CVE-2026-53995 · Severity: high · CVSS 8.2 · Published 2026-10-19

MLflow is a machine learning platform that tracks experiments and traces using a file-based storage system. An unauthenticated attacker can exploit a path traversal flaw in the tracing API to write trace files outside their intended directory, potentially corrupting the filesystem or interfering with other stored data on the server.

Technologies: [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-53995 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53995 being exploited in the wild.

**How severe is CVE-2026-53995?** High severity, with a CVSS score of 8.2, published 19 October 2026.

**Which products and versions are affected?** Databricks MLflow 3.17.1 and earlier when using FileStore tracking backend; mlflow (PyPI) <= 3.17.1, ECOSYSTEM:introduced=0,fixed=3.17.2.

**Is there a fix for CVE-2026-53995?** Yes. mlflow (PyPI): upgrade to 3.17.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-53995 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-53995?** Check whether you run Databricks MLflow or mlflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mlflow (PyPI): upgrade to 3.17.2 or later

  ```sh
  pip install "mlflow>=3.17.2"
  ```


## Technical details

The vulnerability exists in MLflow's FileStore tracking backend, where the POST /api/3.0/mlflow/traces endpoint accepts a client-controlled trace_id that is used directly in filesystem path construction without validation. An attacker can craft a trace ID containing path traversal sequences (e.g., ../../../escaped-trace-dir) to escape the intended experiment trace directory and write trace_info.yaml, request_metadata, and tag files to arbitrary locations subject to the server process's permissions. The FileStore backend is the default in MLflow versions before 3.7.0; later versions use SQLite by default but remain vulnerable when FileStore is explicitly configured.

## Affected products

- Databricks MLflow 3.17.1 and earlier when using FileStore tracking backend

## Identifiers

- CVE-2026-53995
- GHSA-wqmh-qccw-pqwf

## Timeline

- 2026-10-19: disclosed

## References

- [https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal](https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal)
- [https://github.com/mlflow/mlflow/pull/26842](https://github.com/mlflow/mlflow/pull/26842)

## Related threats

- [MLflow arbitrary code execution in third-party scorer deserialization](https://junglewise.ai/threats/cve-2026-116692-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow credential leak in CrewAI autolog](https://junglewise.ai/threats/cve-2026-116691-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow path traversal in prompt model version artifact access](https://junglewise.ai/threats/cve-2026-116690-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow unsafe deserialization in scorer endpoints](https://junglewise.ai/threats/cve-2026-115886-mlflow-is-an-open-source-ai-engineering-platform-for-agents)
- [MLflow statsmodels flavor security control bypass in pickle deserialization](https://junglewise.ai/threats/mlflow-statsmodels-flavor-security-control-bypass-in-pickle-c4a0165d)