MLflow FileStore trace IDs allow path traversal and arbitrary file writes

What's on the official record

20 October — MLflow FileStore path traversal, fixed in 3.17.2. The OSV advisory GHSA-wqmh-qccw-pqwf reports a HIGH-severity path traversal vulnerability (CWE-22) in the PyPI package mlflow, aliased CVE-2026-53995. MLflow 3.17.1 and earlier contains the flaw in the FileStore tracking backend, which allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. The advisory states the issue is fixed in 3.17.2.

Assessment

For a platform or AI-stack owner, the record lets you check whether any MLflow deployment runs 3.17.1 or earlier with the FileStore tracking backend in use, and decide whether to patch to 3.17.2 or restrict access to the traces endpoint before further use.

For a deal team, the record lets you scope diligence on any target whose product or service depends on MLflow tracking, by confirming the deployed version relative to 3.17.2 and whether the FileStore backend and traces endpoint are reachable by unauthenticated callers.

What would change this call

A revised advisory that names additional affected versions, a different fixed version, or a change in severity would change the remediation and diligence guidance above.

What to check next

Confidence

The record is a single OSV advisory (GHSA-wqmh-qccw-pqwf) dated 2026-10-20, with no independent corroboration in this note. The record does not state observed exploitation; FIRST's EPSS estimate for CVE-2026-53995 is 0.006 (p46, 2026-10-24).

Sources

[1] OSV Advisory GHSA-wqmh-qccw-pqwf — https://github.com/advisories/GHSA-wqmh-qccw-pqwf