CVE-2026-2033
Analyzed
8.1
Tracking
Multiple Products
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
Description
MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability
AI Analyst Comment
Remediation
Apply security patches immediately for internet-facing systems. Monitor for exploitation attempts and review access logs.
---METADATA---
VENDOR: MLflow
PRODUCT: Tracking Server
AFFECTED_VERSIONS: 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-105/","name":"ZDI-26-105","tags":["x_research-advisory"]},{"url":"https://github.com/mlflow/mlflow/pull/19260","name":"vendor-provided URL","tags":["vendor-advisory"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T14:11:47.342Z
---END_METADATA---
Description Summary:
MLflow Tracking Server is vulnerable to a directory traversal flaw in the artifact handler, allowing unauthenticated remote attackers to execute arbitrary code.
Executive Summary:
An unauthenticated remote code execution vulnerability in the MLflow Tracking Server poses a critical risk to data integrity and system control.
Vulnerability Details
CVE-ID: CVE-2026-2033
Affected Software: MLflow Tracking Server
Affected Versions: 3.1.1 and 5b9c01925c2e2a8cf0951f155a6a468ff99cfe0f
Vulnerability: The vulnerability is caused by improper input validation of user-supplied paths within the artifact handler, which leads to path traversal. This allows an unauthenticated attacker to manipulate file operations to achieve remote code execution under the context of the service account.
Business Impact
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host server without any authentication. This could lead to a complete system compromise, unauthorized access to sensitive machine learning models and training data, and potential lateral movement within the network. Given the CVSS score of 8.1, the high potential for total impact necessitates immediate attention.
Remediation Plan
Immediate Action: Review the official MLflow repository and vendor advisories for the release of a security patch and apply it immediately upon availability.
Proactive Monitoring: Monitor server access logs for suspicious file paths or directory traversal patterns, such as sequences involving double dots or unexpected system file references.
Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts targeted at the MLflow artifact handling endpoints.
Exploitation Status
Public Exploit Available: Unknown
Analyst Notes: As of February 22, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw's inherent exploitability is high due to the lack of required authentication and the potential for direct code execution.
Analyst Recommendation
This vulnerability represents a significant security exposure due to its unauthenticated nature and the high severity of the potential impact. Organizations utilizing MLflow Tracking Server should prioritize isolating these systems from public-facing networks until a patch is verified and applied. Continuous monitoring of logs is essential to detect any early signs of exploitation attempts while awaiting a formal vendor fix.