CVE-2026-2033: MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of artifact file paths.
Published Feb 21, 2026 · Updated Mar 17, 2026
Affected packages
mlflow
- Ecosystem
- PyPI
- Affected
- < 3.8.0rc0
- Fixed in
- 3.8.0rc0
- Check
pip show mlflow
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow Tracking Server. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of artifact file paths. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the service account.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-2033
- https://github.com/mlflow/mlflow/pull/19260
- https://www.zerodayinitiative.com/advisories/ZDI-26-105
- https://github.com/mlflow/mlflow/commit/5bf2ec2bd4222a18d78631183ac7f6b752afe8a4
- https://github.com/mlflow/mlflow/releases/tag/v3.8.0rc0
- https://github.com/advisories/GHSA-q2r8-vmq7-fpx2
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More MLflow vulnerabilities
All MLflow entriesCVE-2026-115886
MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI evaluate endpoints
medium6.5Oct 23, 2026CVE-2026-53995
MLflow FileStore trace IDs allow path traversal and arbitrary file writes
high8.2Oct 20, 2026GHSA-gqvg-gmmx-x4hm
MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact
high8.8Sep 1, 2026CVE-2026-64849
MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)
critical9.3ExploitedAug 17, 2026CVE-2026-71211
MLflow AI Gateway permits SSRF through an unvalidated api_base
high7.1No fixAug 5, 2026CVE-2026-8147
MLflow: trace API endpoints lack proper authorization validators
high8.1Jul 2, 2026