CVE-2026-2033: MLflow Directory Traversal Remote Code Execution Vulnerability
Summary
CVE-2026-2033: MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. Affects mlflow versions < 3.8.0rc0. Fixed in 3.8.0rc0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MLflow is an open-source platform designed for managing the machine learning lifecycle, including experimentation, reproducibility, and deployment. It provides tools for tracking experiments, packaging code into reproducible runs, and sharing and deploying models. However, a critical vulnerability has been identified in the MLflow Tracking Server, specifically in its artifact handler, which could allow unauthorized remote code execution due to improper validation of user-supplied file paths.
Vulnerability Detail
The vulnerability arises from a directory traversal flaw in the MLflow Tracking Server's artifact handler. This flaw allows attackers to manipulate file paths, leading to arbitrary code execution on the server. The vulnerability is particularly severe because it does not require authentication, making it accessible to any remote attacker. The lack of proper validation of user-supplied paths before they are used in file operations is the root cause, which can result in executing malicious code in the context of the service account.
How To Fix
Latest published version: 3.17.2 as of 23 Oct 2026
pip install --upgrade "mlflow==3.17.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.8.0rc0
This is the first release that contains the fix.
pip install --upgrade "mlflow==3.8.0rc0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the MLflow Tracking Server by implementing network-level security measures, such as firewalls or VPNs, to limit exposure to trusted networks only. Additionally, users should avoid exposing the Tracking Server to the public internet until the package is updated.
Conclusion
The MLflow Tracking Server has a critical vulnerability that allows for remote code execution due to improper handling of file paths. It is crucial for users to update to the latest version to mitigate this risk. Additionally, implementing security measures can help protect against potential exploitation until the update is applied.
See every vulnerability recorded for mlflow →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
No, authentication is not required to exploit this vulnerability, making it particularly dangerous.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to execute arbitrary code on the server, potentially leading to data breaches or service disruptions.
If immediate updates are not possible, implement network security measures to limit access to the MLflow Tracking Server and monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mlflow.
