MLflow Tracking Server
CVE-2025-11201
CRITICAL
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MLflow Tracking REST API
-
DeliverySend crafted model-versions/create request
-
ExploitSupply traversal path in source field
-
ExecutionBypass missing path validation
-
PersistWrite to arbitrary filesystem location
-
ImpactExecute code as service account
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The default MLflow Tracking Server configuration is vulnerable: the fix introduces an OPT-IN environment variable (MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX) and, per the patch docs, 'if the environment variable is not set, no source validation is performed' - so an unpatched or default-configured server validates nothing. The concrete prerequisite is network reachability to the Tracking Server REST API and the ability to call the /mlflow/model-versions/create endpoint with an attacker-controlled 'source' path; no authentication, user interaction, or special feature toggle is required (AV:N/AC:L/PR:N/UI:N). Limiting factors for defenders: exploitation requires network access to the Tracking Server, so instances that are not exposed (bound to localhost, behind an authenticating proxy, or firewalled) or that run patched versions with the source-validation regex set to an allowlist pattern are not reachable by remote unauthenticated attackers. |
| Impact | All exploitation signals point to a genuine high priority. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes fully remote, unauthenticated, low-complexity code execution with total confidentiality, integrity and availability impact - the maximum-risk profile. The CVSS vector and the description are fully consistent: the description explicitly states 'Authentication is not required' and 'remote attackers', matching PR:N and AV:N. This was a coordinated ZDI/Trend Micro disclosure (ZDI-25-931, ZDI-CAN-26921) with a confirmed vendor patch, and the patch diff corroborates the root cause (unvalidated model-version 'source' path in /mlflow/model-versions/create). No EPSS score was supplied in the input, so exploitation-probability cannot be quantified here. KEV status is not present, so there is no evidence of confirmed active exploitation, and no public exploit code is referenced - the ZDI advisory is a disclosure, not weaponized POC. SSVC inputs (exploitation status, automatable, technical impact) were not provided, but the technical impact is clearly 'total' given full C/I/A loss. Bottom line: this is a real, patch-now-class issue for any internet- or network-exposed MLflow Tracking Server, even though no in-the-wild exploitation or POC is confirmed by the available data. |
| Exploit ScenarioDerived | An attacker who can reach the MLflow Tracking Server's REST API (no credentials needed) sends a crafted /mlflow/model-versions/create request whose 'source' path uses directory-traversal sequences to escape the intended artifact location. Because the server performs no validation on the user-supplied path before using it in file operations, the attacker writes to or reads from arbitrary filesystem locations, ultimately executing code as the service account. No public exploit code is referenced in the input, though a ZDI advisory documents the flaw. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Unauthenticated remote code execution affects MLflow Tracking Server deployments that expose the REST API, because the /mlflow/model-versions/create endpoint accepts an attacker-controlled model source path without validating it before file operations. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), and the default configuration is vulnerable since the upstream fix adds an opt-in MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX control that performs no validation when unset. No public exploit code or CISA KEV entry was identified in the provided data; exploitation requires network reachability to the Tracking Server API.
RemediationAI
Apply the upstream fix commit 2e02bc7bb70df243e6eb792689d9b8eba0013161 or upgrade to an MLflow release that contains it; the input data does not provide an exact released version number, so confirm the version in the vendor/GitHub advisory before upgrading. Because the fix is opt-in, also set MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX to a tightly anchored allowlist such as ^mlflow-artifacts:/.*$ (or ^s3://(production-models|staging-models)/.*$) before starting the server - without it, the documentation states no source validation is performed, even on patched code. Trade-offs: an overly broad regex (for example .*) provides no protection, and legitimate model sources outside the allowlist (file://, other S3 buckets) will be rejected, so inventory approved sources first. Compensating controls while patching: bind the Tracking Server to localhost or place it behind an authenticating reverse proxy/firewall so untrusted networks cannot reach /mlflow/model-versions/create; this blocks remote unauthenticated exploitation but disrupts remote CI and client access. Monitor and alert on model-version creation requests with unusual source paths. Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-931/.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MLflow is an open-source machine-learning lifecycle platform whose Tracking Server exposes a REST API for experiment tracking and model registry operations. CVE-2025-11201 is a CWE-22 path traversal in the handling of model file paths: the source field supplied to /mlflow/model-versions/create is used in file operations without proper validation, allowing a remote attacker to influence paths and ultimately execute code in the context of the service account. The affected package is LF Projects MLflow, identified by CPE cpe:2.3:a:lfprojects:mlflow:*:*:*:*:*:*:*:*. The upstream change documents an opt-in regex validation environment variable, MLFLOW_CREATE_MODEL_VERSION_SOURCE_VALIDATION_REGEX, applied with Python re.search() to the source parameter; when it is unset, no validation is performed, which is why default deployments remain exposed.
Know when Mlflow gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description confirms remote unauthenticated exploitation (AV:N/PR:N/UI:N) of a default endpoint with no preconditions (AC:L), yielding arbitrary code execution and full C/I/A loss.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of model file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26921.
Executive ViewAI
CVE-2025-11201 exposes MLflow Tracking Server deployments that publish the REST API to unauthenticated remote code execution, allowing an attacker with network reach to take control of the server and access proprietary models, pipeline credentials, and related data. Leadership should prioritize this because the default configuration is vulnerable and the Tracking Server often sits at the center of machine-learning operations; no public exploit identified at time of analysis, so exposure reduction and patch deployment are the immediate levers.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)NVD
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making
A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. Rated high severity (CVSS 7.5), this vulnerabilit
Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0. Rated critical severity (CVSS 10.0), this vul
Unauthenticated remote code execution in MLflow 3.12.0rc0 through 3.16.x lets any network caller reach the tracking serv
MLflow's FastAPI job endpoints bypass basic-auth entirely, allowing network attackers to submit and execute jobs without
A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models
A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it cou
An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. Rated critical s
An attacker can overwrite any file on the server hosting MLflow without any authentication. Rated critical severity (CVS
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. Rated critical severity (CVSS 9.8), th
Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. Rated critical severity (CVSS 9.8), th
Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. Rated critical se
Exploit-DB