Critical RCE vulnerability discovered in MLflow Tracking Server (CVE‑2026‑2033)

LiveThreat Vulnerability Brief — CVE-2026-2033

What It Is — A critical directory‑traversal flaw in the MLflow Tracking Server’s artifact handler permits unauthenticated attackers to write arbitrary files and achieve remote code execution (RCE) with the service‑account’s privileges. The issue stems from insufficient validation of user‑supplied paths before file‑system operations. Exploitability — The vulnerability is exploitable remotely without authentication; no public exploit has been released yet, but a proof‑of‑concept exists. CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Affected Products — MLflow (open‑source machine‑learning lifecycle platform), specifically any deployment of the MLflow Tracking Server that uses the default artifact handler.

TPRM Impact — Organizations that embed MLflow in their data‑science pipelines, offer it as a managed service, or rely on third‑party MLflow hosting face supply‑chain risk: a compromised tracking server can inject malicious code into model artifacts, corrupt training data, or serve as a foothold for lateral movement across cloud environments.

Recommended Actions —

1. Deploy the MLflow patch (see GitHub pull #19260) immediately on all tracking servers.
2. Restrict network access to the tracking server to trusted subnets or VPNs.
3. Disable or replace the default artifact handler with a hardened, path‑validated alternative.
4. Conduct a forensic review of artifact directories for unexpected files or binaries.
5. Update incident‑response playbooks to include monitoring for anomalous file writes in MLflow directories.

Source: Zero Day Initiative Advisory – ZDI‑26‑105