MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability

The impact of CVE-2025-11201 is severe. An attacker can leverage this vulnerability to execute arbitrary code on the MLflow Tracking Server with the privileges of the service account. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The lack of authentication requirements makes this vulnerability particularly concerning, as it allows unauthenticated attackers to directly exploit the flaw. A successful attack could also be used for lateral movement within the network, potentially compromising other systems connected to the MLflow Tracking Server. The potential blast radius extends to any data stored or processed by the server, including sensitive machine learning models and training data.

Organizations heavily reliant on MLflow for model tracking and deployment are particularly at risk. This includes data science teams, machine learning engineers, and companies deploying machine learning models in production environments. Shared hosting environments where multiple users share the same MLflow instance are also at increased risk, as a compromised model could potentially affect other users.

• python / mlflow:

import os
import subprocess

def check_mlflow_version():
    try:
        result = subprocess.run(['mlflow', '--version'], capture_output=True, text=True, check=True)
        version = result.stdout.strip()
        if version <= '3.0.0rc3':
            print(f"MLflow version is vulnerable: {version}")
        else:
            print(f"MLflow version is patched: {version}")
    except FileNotFoundError:
        print("MLflow is not installed.")
    except subprocess.CalledProcessError as e:
        print(f"Error checking MLflow version: {e}")

check_mlflow_version()

• linux / server: journalctl filters for suspicious process executions within the MLflow Tracking Server directory.

journalctl -u mlflow-tracking-server -g 'path=/path/to/mlflow/models/'

1. 2025-10-29Disclosure

   disclosure

2. 2025-10-29Patch

   patch

1. Reserviert2025-09-30
2. Veröffentlicht2025-10-29
3. Geändert2025-12-05
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-11201 is to upgrade to MLflow Tracking Server version 3.0.0 or later, which includes the necessary path validation fixes. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict network access to the MLflow Tracking Server to only authorized users and systems. Implement a Web Application Firewall (WAF) with rules to block suspicious file path manipulation attempts. Monitor system logs for unusual activity, particularly related to file creation and execution. After upgrading, confirm the fix by attempting to create a model with a specially crafted path containing directory traversal sequences; the server should reject the request.