CVE-2026-53995: MLflow path traversal in FileStore trace writes via POST /api/3.0/mlflow/traces

Summary

MLflow 3.17.1 and earlier contains a path traversal flaw in the FileStore tracking backend. An unauthenticated attacker can submit a crafted trace ID with traversal sequences to POST /api/3.0/mlflow/traces, causing FileStore.start_trace() to write trace_info.yaml, request_metadata and tag files outside the intended experiment trace directory, limited by the server process's filesystem permissions. FileStore is the default backend before MLflow 3.7.0 and opt-in afterward, so earlier deployments are exposed by default while later ones are exposed only when FileStore is explicitly selected.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• HighCVE-2026-77926: Aix-DB remote code execution through ChatBI common agent execute toolSimilar attack · NVD/CVE Database
• CriticalCVE-2026-75128: Langchain-Chatchat unauthenticated shell command executionSimilar attack · NVD/CVE Database
• HighCVE-2026-109443: JoySafeter remote code execution via unsandboxed execute tool in CopilotSimilar attack · NVD/CVE Database
• HighCVE-2026-107366: IBM Langflow OSS message endpoints lack ownership verificationSimilar attack · NVD/CVE Database
• MediumGHSA-2658-85cv-9wwq: Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTMLSimilar attack · GitHub Advisory Database