CVE-2026-53995

MLflow trace IDs can redirect FileStore metadata writes

MLflow · FileStore tracking backend / StartTraceV3

First documented disclosure · Review checkpoint

Summary

A crafted trace ID can write MLflow trace files outside the intended experiment directory.

Severity and exploitation evidence

High · 8.8/10 · CVSS 4.0. Severity source.

Exploitation not established: Reviewed disclosure and controlled research; malicious exploitation is not established.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

FileStore joins a supplied trace ID into paths used for trace_info.yaml, metadata and tag files without rejecting path traversal.

Conditions required

A FileStore-backed tracking server accepts the request; unauthenticated access requires exposed endpoints without access controls. FileStore was the default before 3.7.0 and is opt-in afterward.

Potential impact

Unexpected trace-format file writes and limited availability impact, constrained by service filesystem permissions. Arbitrary file contents, data exfiltration and code execution were not demonstrated.

Affected versions and configurations

CNA lists <=3.17.1. Static inspection also finds the unvalidated start_trace path in the latest published 3.17.2 tag.

Fix and mitigation status

Main-branch fixes are merged, including d64cc8b on October 29; no containing packaged release was verified.

Practical next steps

Restrict tracking access and use a supported database-backed store where feasible. Apply a reviewed upstream fix if maintaining a fork; verify release inclusion before assuming an upgrade closes the issue.

Operating lesson

Identifiers that become filesystem paths need strict validation at every write boundary.

Evidence and limits

Public PR October 17; CNA October 19, amended November 2. The researcher used Flask’s local test client, which does not establish Internet exposure. The latest PyPI/GitHub release remains 3.17.2 and its source lacks the newer path-component validation. CNA 8.8 CVSS 4.0 and researcher 8.2 v3.1 are source-specific scores.

Sources