CVE-2026-2033: 
MLflow vulnerability analysis and mitigation

CVE-2026-2033 is a path traversal vulnerability in MLflow Tracking Server that allows unauthenticated remote attackers to execute arbitrary code. The flaw exists within the handling of artifact file paths, where user-supplied paths are not properly validated before use in file operations. It was reported to the vendor on 2025-07-31 and publicly disclosed on 2026-02-13 via a coordinated release. The vulnerability carries a CVSS v3.0 base score of 8.1 (High) (ZDI Advisory, MLflow PR #19260).

The root cause is improper limitation of a pathname to a restricted directory (CWE-22 — Path Traversal). Specifically, the MLflow Tracking Server's local file store backend failed to validate artifact file paths before performing file operations, allowing attackers to place malicious meta.yaml files in artifact folders to traverse outside intended directories. The fix, implemented in mlflow/store/tracking/file_store.py, adds a _is_valid_run_directory() method that validates run directory structure (checking for required subdirectories: metrics/, params/, artifacts/) and integrates this check into _find_run_root() to reject invalid run directories. The vulnerability is tracked internally as ZDI-CAN-26649 and was discovered by researcher Muhammad Fadilullah Dzaki (ZDI Advisory, MLflow PR #19260).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code in the context of the MLflow Tracking Server's service account, resulting in high confidentiality, integrity, and availability impact. This could lead to full system compromise of the MLflow server, unauthorized access to sensitive ML model data and experiment artifacts, lateral movement within the network, and potential denial of service (ZDI Advisory).

A proof-of-concept exploit reference is available via the Zero Day Initiative advisory (ZDI-26-105), published on 2026-02-13. No evidence of active in-the-wild exploitation has been reported at this time. The vulnerability requires no authentication and no user interaction, though attack complexity is rated High. The EPSS score is approximately 0.1558 (15.58%), indicating a moderate probability of exploitation. The vulnerability does not appear in the CISA KEV catalog as of the time of this report (ZDI Advisory).

1. Reconnaissance: Identify internet-facing MLflow Tracking Server instances using tools like Shodan or Censys, or by scanning for the default MLflow port (5000/TCP). Confirm the server is running a vulnerable version prior to the patch in PR #19260 (pre-v3.7.1).
2. Craft malicious artifact path: Prepare a malicious meta.yaml file containing path traversal sequences (e.g., ../../) designed to escape the intended artifact directory and reference files or directories outside the MLflow run root.
3. Upload malicious artifact: Submit the crafted artifact file path to the MLflow Tracking Server's artifact handling endpoint without authentication, leveraging the lack of input validation on user-supplied paths.
4. Trigger path traversal: The server processes the malicious path in file operations, allowing the attacker to read, write, or execute files outside the intended artifact directory — including sensitive configuration files or writable locations that can be used for code execution.
5. Achieve code execution: By writing a malicious payload (e.g., a script or binary) to an executable location accessible by the service account, or by manipulating server-side files, the attacker achieves remote code execution in the context of the MLflow service account (ZDI Advisory, MLflow PR #19260).

• Network: Unexpected HTTP requests to MLflow Tracking Server artifact endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f, %2e%2e/) in file path parameters; outbound connections from the MLflow server process to unknown external IPs.
• File System: Presence of unexpected meta.yaml files in artifact subdirectories outside normal run structures; new or modified files in directories outside the MLflow artifact root; unexpected scripts or binaries in writable directories accessible by the MLflow service account.
• Logs: MLflow server access logs showing requests with encoded or raw path traversal sequences in artifact path parameters; file operation errors or exceptions in MLflow server logs referencing paths outside the expected artifact directory.
• Process: Unusual child processes spawned by the MLflow server process (e.g., bash, sh, python, curl, wget); unexpected network connections initiated by the MLflow service account.

MLflow has released a patch addressing this vulnerability in pull request #19260, merged into the master branch on December 10, 2025, and labeled for inclusion in version 3.7.1. Users should upgrade to MLflow v3.7.1 or later immediately. As a temporary workaround if patching is not immediately possible, implement network segmentation to restrict access to MLflow Tracking Server endpoints to trusted hosts only, and monitor for suspicious artifact upload activity. Avoid exposing MLflow Tracking Server instances directly to the internet (MLflow PR #19260, ZDI Advisory).

The vulnerability received coverage on social media platforms including Mastodon and Bluesky via The Hacker Wire, and was discussed in the r/netsec subreddit in a thread covering 22 security advisories for AI/ML software. The Secret CISO newsletter also highlighted the vulnerability in its February 21, 2026 edition. Community interest reflects growing concern about security in AI/ML infrastructure tools, with the Reddit thread noting the broader trend of vulnerabilities in AI/ML platforms (ZDI Advisory).