MLflow CVE-2026-2033
HIGH
GHSA-q2r8-vmq7-fpx2
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Unauthenticated network-reachable traversal yielding code execution as the service account justifies PR:N/AC:L and High C/I/A; scope unchanged as code runs within the server's own context.
Primary rating from Vendor (trendmicro).
CVSS VectorVendor: trendmicro
Lifecycle Timeline
10DescriptionCVE.org
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26649.
AnalysisAI
Remote code execution in the MLflow Tracking Server allows unauthenticated attackers (PR:N) to abuse the artifact handler's path processing to read or write files outside the intended artifact root and ultimately run code as the server's service account. The flaw is a CWE-22 path traversal in artifact file-path handling reachable over the network with low complexity. No public exploit is identified at time of analysis, but the EPSS score of 15.58% (95th percentile) signals notably elevated near-term exploitation likelihood for an MLOps component frequently exposed on internal and cloud networks.
Technical ContextAI
MLflow is a widely used open-source platform for managing the machine-learning lifecycle (experiment tracking, model registry, artifact storage). The Tracking Server exposes REST/HTTP endpoints, including an artifact handler that maps user-supplied artifact paths to files on the backing store or local filesystem. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): the handler uses an attacker-controlled path in file operations without canonicalizing or validating it against the artifact root, so traversal sequences (e.g. ../) escape the intended directory. Because artifacts can be both read and written through this interface, a traversal write primitive can be chained into code execution in the context of the MLflow service process. The upstream fix is tracked in mlflow/mlflow pull request #19260; Red Hat is tracking downstream impact via Bugzilla 2441508 and a CSAF/VEX record.
Affected ProductsAI
The affected product is the MLflow Tracking Server (mlflow/mlflow open-source project). Exact fixed and affected version boundaries are not enumerated in the provided NVD data (no CPE version ranges were supplied); the fix is associated with mlflow/mlflow pull request #19260 (https://github.com/mlflow/mlflow/pull/19260), and the issue is documented in the Zero Day Initiative advisory ZDI-26-105 (https://www.zerodayinitiative.com/advisories/ZDI-26-105/). Red Hat tracks downstream package exposure at https://access.redhat.com/security/cve/CVE-2026-2033, https://bugzilla.redhat.com/show_bug.cgi?id=2441508, and the machine-readable VEX at https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2033.json. Administrators should confirm the precise patched release tag against the PR and ZDI advisory before remediation.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the patch corresponding to mlflow/mlflow pull request #19260 (https://github.com/mlflow/mlflow/pull/19260) once it lands in a tagged MLflow release, and cross-check the fixed version against ZDI-26-105 (https://www.zerodayinitiative.com/advisories/ZDI-26-105/) and the Red Hat CVE page (https://access.redhat.com/security/cve/CVE-2026-2033). Until a confirmed patched version is deployed, restrict network exposure of the Tracking Server: place it behind authentication and a reverse proxy, and block direct access to the artifact endpoints from untrusted networks (do not expose the server on 0.0.0.0 or the public internet), accepting that legitimate remote clients and CI runners must then be allowlisted or routed through the proxy. Where feasible, run the Tracking Server under a low-privilege, sandboxed service account with a tightly scoped artifact directory and strict filesystem permissions so a traversal write cannot reach executable or startup paths - the trade-off is that overly strict permissions may break artifact upload and require configuration tuning.
Same weakness CWE-22 – Path Traversal
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today