CVE-2026-2033: Critical MLflow Tracking Server Flaw Enables Directory Traversal and Potential Remote Code Execution

CVE-2026-2033 – MLflow Tracking Server Directory Traversal to Remote Code Execution

CVE ID: CVE-2026-2033
Product: MLflow Tracking Server
Vulnerability Type: Directory Traversal leading to Remote Code Execution (RCE)
CVSS v3.1 Score: 8.1 (High)
Vector: AV:N / AC:H / PR:N / UI:N / S:U / C:H / I:H / A:H
Attack Type: Remote, unauthenticated (in exposed deployments)
Exploitability: Technically feasible; no mass exploitation observed at scale at time of disclosure
Impact: Full compromise of MLflow Tracking Server host under service account privileges

Overview

A directory traversal vulnerability was identified in the MLflow Tracking Server’s artifact handling mechanism. The issue allowed specially crafted artifact metadata or artifact location paths to bypass expected directory boundaries. In affected versions, insufficient validation of run directory structure permitted attacker-controlled paths to be treated as legitimate artifact roots.

Under certain deployment scenarios, this weakness could be chained into remote code execution. If a tracking server was exposed to untrusted networks and artifact uploads were permitted without strict access controls, exploitation could occur without authentication.

The flaw resided in how MLflow validated and resolved artifact paths when processing run metadata, particularly involving meta.yaml and artifact location references.

Technical Root Cause

The MLflow Tracking Server processes run metadata and artifact paths that are supplied during experiment tracking operations. In vulnerable builds:

Artifact directories were resolved without strict canonicalization checks.
Directory traversal sequences such as ../ or encoded equivalents were not consistently rejected.
Artifact root validation logic did not enforce strict containment within the designated artifact storage directory.
Maliciously structured meta.yaml files could influence run directory resolution.

If a crafted artifact path escaped the expected root, file system operations could occur outside the intended storage area. Once arbitrary file write or read capability was achieved within the server context, further abuse became possible.

Because MLflow commonly runs as a service account on Linux servers, exploitation would execute with that account’s permissions.

Affected Deployment Scenarios

Risk was significantly higher under these conditions:

MLflow Tracking Server exposed over HTTP to public or semi-public networks
Artifact storage located on the local filesystem
Tracking server running with write permissions beyond the artifact root
Weak or absent authentication controls
Shared host environments where MLflow service account had elevated privileges

Environments using strictly isolated object storage backends with hardened IAM controls were comparatively less exposed, but not immune if path resolution logic was still abused internally.

Exploitation Details (Educational)

The following explanation is provided for defensive understanding only.

A typical attack chain could involve:

A malicious run creation request submitted to the tracking API.
A manipulated artifact_location parameter containing traversal sequences.
The server resolving the path without strict boundary enforcement.
Writing or accessing files outside the designated artifact directory.

In a realistic scenario, an attacker could attempt to:

Overwrite Python modules used by MLflow.
Modify configuration files.
Plant a malicious file that gets executed during model loading.
Abuse deserialization logic in downstream workflows.

Example traversal patterns that may be observed in malicious payloads:

artifact_location=../../../../tmp/evil
artifact_location=%2e%2e/%2e%2e/%2e%2e/tmp/evil
artifact_location=file:///etc/
artifact_location=/var/lib/mlflow/../app/

Malicious meta.yaml manipulation may include injected artifact paths pointing outside the expected run structure.

No weaponized exploit code is provided here. However, the vulnerability is technically exploitable with carefully crafted HTTP requests against the tracking API.

Indicators of Exploitation

The following anomalies should be investigated:

Artifact directories created outside the configured root.
Unexpected modification timestamps on system or application files.
MLflow process accessing /etc/, /var/, /home/, or application directories.
Creation of new Python files not deployed via CI/CD.
Suspicious outbound connections from the MLflow host.
Error logs referencing invalid run roots or malformed metadata.

Log Sources for Detection

Web server access logs (Nginx, Apache, load balancer)
MLflow application logs
System audit logs (auditd, Windows Event Logs)
File integrity monitoring logs
Endpoint detection telemetry
Container runtime logs (if deployed in Docker/Kubernetes)

Detection Queries

1. Web Server Logs – Path Traversal in Request Parameters

Generic Log Search (Elasticsearch / OpenSearch):

request:*artifact_location* AND 
(request:*../* OR request:*%2e%2e%2f* OR request:*file://*)

2. Splunk Query – Suspicious Artifact Path

index=web_logs 
("artifact_location=" OR "source=") 
("../" OR "%2e%2e%2f" OR "file://") 
| stats count by src_ip, uri, http_method

3. MLflow Application Logs – Invalid Run Root Errors

index=mlflow_logs 
("invalid run directory" OR "malformed meta.yaml" OR "_find_run_root")
| stats count by host, message

4. Linux Auditd – Unexpected File Writes by MLflow Process

index=audit_logs 
process_name=mlflow 
AND (file_path="/etc/*" OR file_path="/usr/*" OR file_path="/var/*")

5. File Integrity Monitoring – Suspicious Modifications

index=fim_logs 
user=mlflow 
| where file_path NOT LIKE "/mlartifacts/%"

MITRE ATT&CK Mapping

T1190 – Exploit Public-Facing Application
T1059 – Command and Scripting Interpreter
T1105 – Ingress Tool Transfer
T1562 – Impair Defenses
T1574 – Hijack Execution Flow

Risk Assessment

Although the CVSS score is 8.1, real-world risk depends heavily on exposure:

Public-facing tracking servers are high risk.
Internal-only deployments remain vulnerable if lateral movement is possible.
Containerized deployments reduce but do not eliminate impact.
Systems where MLflow runs with broad file permissions are at highest risk.

Confidentiality, integrity, and availability can all be impacted.

Remediation

Upgrade Immediately

The vulnerability has been addressed in upstream MLflow. All deployments should upgrade to a version that includes the official fix.

Official Patch / Upgrade Reference:
https://github.com/mlflow/mlflow/pull/19260

Upgrade to the latest MLflow release that contains this patch or any newer stable version.

Hardening Recommendations

Restrict network access to the tracking server.
Enforce authentication on all tracking endpoints.
Run MLflow under a minimally privileged service account.
Store artifacts in isolated object storage with strict IAM policies.
Enable file integrity monitoring.
Deploy WAF rules blocking traversal patterns.
Implement container sandboxing where feasible.

Post-Upgrade Validation

After patching:

Attempt controlled traversal tests in a staging environment to confirm rejection.
Validate that artifact uploads cannot escape the configured root.
Confirm no legacy artifact directories exist outside expected boundaries.
Review logs for any historical suspicious requests.

Final Takeaway

A directory traversal weakness in MLflow’s artifact resolution logic could be leveraged to achieve remote code execution under certain deployment conditions. The issue is serious but preventable. Immediate upgrading and improved monitoring are strongly recommended. Environments where MLflow is internet-facing should treat this as urgent.