Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-10-19T21:05:16 mlflow: mlflow: Arbitrary file write via FileStore path traversal 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L CWE-22

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.

A flaw was found in MLflow. An unauthenticated remote attacker can achieve arbitrary file write by submitting a crafted trace identifier containing path traversal sequences to the FileStore tracking backend. This vulnerability allows the attacker to write metadata files outside the intended directory on the server's filesystem, subject to the server process's file permissions.

Red Hat has rated this vulnerability as Important because an unauthenticated remote client can leverage path traversal sequences in trace requests to create metadata files outside the designated storage directory. The flaw carries high integrity risk due to the lack of authentication on the trace ingestion endpoint, though exploitation is constrained by the operating system permissions assigned to the MLflow service. In Red Hat OpenShift AI, exposure is limited to deployments where the MLflow server is reachable by untrusted network actors and configured to use the local FileStore backend rather than a relational database. --- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure. The highest-value action is to validate client-supplied trace identifiers and enforce directory boundaries within the FileStore tracking backend before writing trace metadata: upgrade to the fixed Rhoai/Odh Training Cuda128 Torch29 Py312 Rhel/Rhoai/Odh Mlflow Rhel/Rhoai/Odh Pipeline Runtime Datascience Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Pipeline Runtime Pytorch Rocm Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Cuda Py312 Rhel/Rhoai/Odh Th06 Cpu Torch210 Py312 Rhel/Rhoai/Odh Th06 Cuda130 Torch210 Py312 Rhel/Rhoai/Odh Th06 Rocm64 Torch291 Py312 Rhel/Rhoai/Odh Workbench Codeserver Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Datascience Cpu Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Llmcompressor Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Pytorch Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Cuda Py312 Rhel/Rhoai/Odh Workbench Jupyter Trustyai Cpu Py312 Rhel/Rhoai/Odh Pipeline Runtime Tensorflow Rocm Py312 Rhel/Rhoai/Odh Workbench Jupyter Tensorflow Rocm Py312 Rhel/Rhoai/Odh Th Torch Cpu Py312 Rhel/Rhoai/Odh Th Torch Cuda Py312 Rhel/Rhoai/Odh Th Torch Rocm Py312 Rhel/Google Lightspeed Agent builds, which validate trace IDs as safe directory names and verify resolved directory boundaries before trace operations, returning an HTTP 400 error for unsafe IDs, closing crafted trace identifier with directory traversal sequences in POST /api/3.0/mlflow/traces. Until patched, this is a concern on MLflow tracking servers configured to use the FileStore tracking backend, so restrict network access to the POST /api/3.0/mlflow/traces endpoint or migrate the tracking store from FileStore to a database backend such as SQLite. As a compensating measure, normalize and canonicalize trace IDs and file paths before security checks to prevent traversal bypasses using encoding or relative references, inspect incoming POST requests to /api/3.0/mlflow/traces for directory traversal patterns such as '../' and block the payload at the perimeter using a web application firewall, and detect anomalous file write activity performed by the MLflow process outside its designated storage directory via eBPF runtime monitoring. These controls limit blast radius and contain exploitation, but they do not fix the underlying path traversal defect — apply the upstream patch to fully remediate. Highest-impact CME: CME-1301 Path Traversal Prevention (Canonicalization) (high) Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cpu-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-cuda130-torch210-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-th06-rocm64-torch291-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th-torch-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th-torch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-th-torch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-53995 https://nvd.nist.gov/vuln/detail/CVE-2026-53995 https://github.com/SaiTeja-Erukude/CVE-2026-53995-mlflow-path-traversal https://github.com/mlflow/mlflow/pull/26842 https://www.vulncheck.com/advisories/mlflow-path-traversal-via-trace-id-api