CVE-2026-127202: MLflow FileStore lets unauthenticated callers write outside the run directory via model_id in log_outputs, fixed in 3.18.0
MLflow tracking servers before 3.18.0 that use the FileStore backend join the model_id from POST /api/3.0/mlflow/runs/outputs into a path without checking it. An unauthenticated caller can send ../ sequences to create directories and write a meta.yaml file anywhere the server account can write. Upgrade to 3.18.0.
What it is
FileStore.log_outputs joined the request model_id into <run>/outputs/<model_id> and created the directory, so a model_id containing .. or an absolute path resolved outside the run (PR #27131, merged 26 Oct 2026).
The fix validates model ids as a single path component in log_outputs, and also in _get_model_dir, which covers model metrics.
FileStore was the default backend before MLflow 3.7.0; from 3.7.0 it is opt-in through MLFLOW_ALLOW_FILE_STORE. Servers on a database backend are not affected by this bug. It follows the earlier FileStore trace path traversal CVE-2026-53995.
Reported by Florian Kabashi; CVE assigned by VulnCheck on 12 Nov 2026.
How to check
- Run pip show mlflow and see whether the version is below 3.18.0.
- Check whether your tracking server uses a file-based backend store (a local path or file:// URI, or MLFLOW_ALLOW_FILE_STORE set) and whether it is reachable without authentication.
How to fix
- Upgrade MLflow to 3.18.0 or later.
- Move the tracking server to a database backend, keep it off untrusted networks or behind authentication, and run it as a low-privilege account.
pip show mlflow | grep -i ^version
pip install -U 'mlflow>=3.18.0'Sources
- criticalCVE-2026-116692: MLflow 3.17.0 fixes unauthenticated code execution through third-party scorers, an arbitrary file read through prompt versions, and CrewAI API keys leaking into traces
- highCVE-2026-118628 and five more: MLflow before 3.17.0 has an unauthenticated SSRF in get-artifacts, two unsafe-deserialization code execution bugs and three missing permission checks, upgrade to 3.17.0
- highCVE-2026-53995: MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem
- mediumCVE-2026-115886: MLflow scorer endpoints allow unauthenticated SSRF