{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/mlflow--3.17.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MLflow (\u003c= 3.17.1)"],"_cs_severities":["medium"],"_cs_tags":["path-traversal","cve-2026-53995","mlflow","vulnerability"],"_cs_type":"advisory","_cs_vendors":["MLflow"],"content_html":"\u003cp\u003eMLflow versions through 3.17.1 contain a path traversal vulnerability in the FileStore component, identified as CVE-2026-53995. The flaw exists within the handling of the \u003ccode\u003etrace_id\u003c/code\u003e parameter when processing requests to the \u003ccode\u003e/api/3.0/mlflow/traces\u003c/code\u003e endpoint. By submitting a \u003ccode\u003etrace_id\u003c/code\u003e containing directory traversal sequences, such as \u003ccode\u003e../../../\u003c/code\u003e, an attacker can bypass the intended directory structure of the \u003ccode\u003emlruns/\u003c/code\u003e storage path.\u003c/p\u003e\n\u003cp\u003eWhen the \u003ccode\u003eFileStore.start_trace()\u003c/code\u003e function processes the \u003ccode\u003etrace_info\u003c/code\u003e proto containing a malicious ID, it incorrectly joins the path, enabling the application to write metadata, trace information, and tag files outside of the designated experiment trace directory. This vulnerability provides an arbitrary file write primitive, which could be leveraged to overwrite configuration files or place malicious files on the host filesystem. The issue was disclosed by Sai Teja Erukude and confirmed to affect the standard FileStore backend implementation in MLflow.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a target running an vulnerable MLflow instance (\u0026lt;= 3.17.1).\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious \u003ccode\u003eStartTraceV3\u003c/code\u003e request targeting the \u003ccode\u003e/api/3.0/mlflow/traces\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003etrace_id\u003c/code\u003e field within the JSON request body is populated with path traversal sequences like \u003ccode\u003e../../../[custom-dir]\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe MLflow server receives the request and parses the \u003ccode\u003etrace_info\u003c/code\u003e structure.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eFileStore\u003c/code\u003e component incorrectly joins the malicious \u003ccode\u003etrace_id\u003c/code\u003e with the base storage path.\u003c/li\u003e\n\u003cli\u003eThe application resolves the path to a location outside of the intended \u003ccode\u003emlruns/\u003c/code\u003e directory hierarchy.\u003c/li\u003e\n\u003cli\u003eThe application writes trace metadata, tags, and state files to the attacker-controlled path on the underlying filesystem.\u003c/li\u003e\n\u003cli\u003eAttacker successfully creates or overwrites files on the host system, potentially leading to further compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary file creation on the filesystem where MLflow is deployed. This can result in unauthorized data modification, potential service disruption, or the placement of malicious artifacts. While the CVSS score is 6.2, the impact depends on the service account privileges running the MLflow server, which could grant an attacker write access to sensitive system directories or application configurations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering and security teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImplement strict input validation on the \u003ccode\u003etrace_id\u003c/code\u003e field in the MLflow API to reject path separators, traversal segments (\u003ccode\u003e../\u003c/code\u003e), absolute paths, and drive letters.\u003c/li\u003e\n\u003cli\u003eDeploy an allow-list for \u003ccode\u003etrace_id\u003c/code\u003e components to ensure all trace storage operations remain within the designated experiment trace directory.\u003c/li\u003e\n\u003cli\u003eMonitor webserver access logs for POST requests to \u003ccode\u003e/api/3.0/mlflow/traces\u003c/code\u003e containing path traversal sequences or unexpected characters in the request body.\u003c/li\u003e\n\u003cli\u003eRestrict access to the trace-creation endpoint until a patched version of MLflow is deployed to your environment.\u003c/li\u003e\n\u003cli\u003eIf feasible, migrate trace tracking from the FileStore backend to a secure SQL backend, ensuring appropriate compatibility checks are performed.\u003c/li\u003e\n\u003cli\u003eReview the provided \u003ccode\u003efix.md\u003c/code\u003e and reproduction \u003ccode\u003erun_poc.py\u003c/code\u003e to understand the vulnerable path resolution logic and validate internal environments against the documented regression patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T01:12:45Z","date_published":"2026-10-18T01:12:45Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mlflow-path-traversal/","summary":"MLflow FileStore is vulnerable to a path traversal attack allowing arbitrary file creation through malicious trace_id parameters in the start_trace_v3 API endpoint.","title":"Path Traversal in MLflow FileStore via CVE-2026-53995","url":"https://feed.craftedsignal.io/briefs/2026-10-mlflow-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - MLflow (\u003c= 3.17.1)","version":"https://jsonfeed.org/version/1.1"}