PatchSiren cyber security CVE debrief

CVE-2026-2033 MLflow CVE debrief

CVE-2026-2033 is a high-severity vulnerability in MLflow Tracking Server, allowing remote code execution via directory traversal. The vulnerability exists in the handling of artifact file paths, where user-supplied paths are not properly validated before use in file operations. This allows remote attackers to execute arbitrary code on affected installations without requiring authentication. The vulnerability is tracked as ZDI-CAN-26649 and has a CVSS score of 7.3. To address this vulnerability, defenders should prioritize patching affected MLflow Tracking Server installations.

Vendor: MLflow
Product: Unknown
CVSS: HIGH 7.3
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-02-20
Original CVE updated: 2026-07-15
Advisory published: 2026-02-20
Advisory updated: 2026-07-15

Who should care

Organizations using MLflow Tracking Server should prioritize patching this high-severity vulnerability to prevent remote code execution attacks. The vulnerability's lack of required authentication and high CVSS score emphasize the need for swift action. Defenders should review their inventory of MLflow Tracking Server installations and ensure they are updated to a patched version.

Technical summary

The MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability (CVE-2026-2033) allows remote attackers to execute arbitrary code on affected installations. The vulnerability exists due to improper validation of user-supplied paths in artifact file operations. Attackers can leverage this vulnerability to execute code in the context of the service account. The vulnerability has a CVSS score of 7.3 and is considered high-severity. The CWE-22 weakness is associated with this vulnerability.

Defensive priority

Defenders should prioritize patching affected MLflow Tracking Server installations to address this high-severity vulnerability. Reviewing inventory and ensuring updates to patched versions are crucial steps in mitigating this vulnerability.

Recommended defensive actions

Patch affected MLflow Tracking Server installations
Review inventory of MLflow Tracking Server installations
Ensure updates to patched versions are applied
Monitor for suspicious activity related to MLflow Tracking Server
Implement compensating controls to limit exposure

Evidence notes

The CVE-2026-2033 vulnerability is based on information from official sources, including CVE.org and the National Vulnerability Database (NVD). The vulnerability is tracked as ZDI-CAN-26649 by the Zero Day Initiative. Red Hat has also published information related to this vulnerability.

Sources and references

Verified primary and authoritative sources

CVE-2026-2033 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-2033

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-2033 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-2033

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://github.com/mlflow/mlflow/pull/19260

[email protected]
Source reference
Unverified legacy reference

URL: https://www.zerodayinitiative.com/advisories/ZDI-26-105/

[email protected]
Source reference
Unverified legacy reference

URL: https://access.redhat.com/security/cve/CVE-2026-2033

0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Source reference
Unverified legacy reference

URL: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2033.json

0b0ca135-0b70-47e7-9f44-1890c2a1c46c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.