CVE-2026-127202

MLflow model-output metadata could be written outside the run directory

MLflow · FileStore model-output logging

First documented disclosure · Review checkpoint

Summary

FileStore used a supplied model identifier as part of a filesystem path without confining the result to the run. A client could create or overwrite model-output metadata outside the intended directory under the server account.

Severity and exploitation evidence

Medium · 6.3/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the weakness and correction. They identify no confirmed malicious use.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

FileStore used a supplied model identifier as part of a filesystem path without confining the result to the run.

Conditions required

The server uses FileStore, accepts output-logging requests from the caller and has write permission at the destination.

Potential impact

A client could create or overwrite model-output metadata outside the intended directory under the server account.

Affected versions and configurations

Before 3.18.0 when FileStore is in use. It was the default backend before 3.7.0 and is opt-in on later releases, per the CNA.

Fix and mitigation status

3.18.0 for this issue.

Practical next steps

Upgrade to a supported release containing the 3.18.0 fix. Limit access to tracking APIs and review the service account’s filesystem permissions.

Operating lesson

Constrain each identifier to a single path component and run the tracking service with narrowly scoped write permissions.

Evidence and limits

This affects the model identifier used by output logging. The trace-ID and artifact-host advisories concern different inputs. The issuing CNA published the CVE record on 2026-11-12.

Sources