Database/AI/ML frameworks & serving
MLflow: path traversal in model_id lets unauthenticated clients write files outside the run directory
Impact
The POST /api/3.0/mlflow/runs/outputs endpoint does not validate model_id. A value containing ../ makes the server create directories and write a meta.yaml file anywhere the server account can write. The attacker controls where the file goes but not, from what the record says, much of what goes in it. Writes to arbitrary locations can still corrupt other experiments' metadata on a shared tracking server. Only the FileStore backend is affected. FileStore was the default before 3.7.0 and is opt-in afterwards through MLFLOW_ALLOW_FILE_STORE.
Who can reach it
Anyone who can reach the MLflow tracking server API. No authentication is needed if the deployment does not enforce any. The server must be using the FileStore backend.
What to do
Upgrade MLflow to 3.18.0 or later and restart the tracking server. Moving to a database-backed store removes the vulnerable code path. Restrict network access to the tracking server and run it as an unprivileged account with a confined writable area.
References
Related entries
- TrustyAI Service Operator: unauthenticated access to AI guardrail and orchestrator APIsCVE-2026-15044 · TrustyAI Service Operator (Red Hat OpenShift AI)Medium
- llama.cpp: oversized seq_id in a saved slot file leaks heap memory past the cells arrayCVE-2026-43630 · llama.cpp server (recurrent memory state slot-restore path)Medium
- vLLM: race in the prompt_embeds sparse-tensor guard reopens the CVE-2025-62164 crash pathCVE-2026-73557 · vLLM prompt_embeds loader (safe_load_prompt_embeds sparse-tensor guard)Medium
- Eclipse Che dashboard backend (POST /dashboard/api/data/resolver): The dashboard backend passes a user-supplied URLCVE-2026-86590 · Eclipse Che dashboard backend (POST /dashboard/api/data/resolver)Medium
- vLLM: allowed_token_ids validated against tokenizer length, corrupting shared GPU logit-bias stateCVE-2026-93840 · vLLM (SamplingParams allowed_token_ids validation / LogitBiasState)Medium
- vLLM: unbounded prompt token ids write out of bounds in the penalty bincount Triton kernelCVE-2026-93841 · vLLM (Triton _bincount_kernel, penalty prompt-presence bitset)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.