External risk intelligence

MLflow Tracking Server Directory Traversal Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-11201

MLflow Tracking Server is commonly deployed as a centralized, network-accessible service to manage machine learning model lifecycles and experiments. As a shared platform often accessible to teams over a network, its service endpoints are frequently exposed in enterprise environments to facilitate model registration and artifact tracking, making it a common target for network-based interaction.

Path Traversal

Lfprojects Mlflow

before 2025-06-10

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in MLflow Tracking Server, a platform used for managing machine learning projects. This flaw could allow unauthenticated attackers to execute arbitrary code on affected systems by manipulating file paths. The main concern is to confirm if your organization uses this technology and is potentially exposed.

Unauthenticated code execution risk in MLflow.
Affects central machine learning management.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach the MLflow Tracking Server over the network and create a model with a specially crafted path. This path tricks the server into writing files outside its intended directory, potentially leading to the execution of arbitrary code with the server's permissions.

No authentication required.
Crafted model path triggers vulnerability.
Remote code execution risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary code on an MLflow Tracking Server. This is possible by crafting a malicious file path that exploits a flaw in how the server handles model file operations, potentially leading to code execution with the privileges of the service account.

Affected asset: MLflow Tracking Server files.
Exposure: Malicious file path.
Consequence: Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determine ownership and immediate exposure of MLflow Tracking Server instances. Prioritize systems that are network-accessible and critical to business operations to plan remediation or implement temporary risk reduction measures.

MLflow administrators own this vulnerability.
Verify network exposure and critical system impact.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the MLflow Tracking Server used for?

MLflow Tracking Server is a component of the MLflow open-source platform, which is widely used by data science and engineering teams to manage the machine learning lifecycle. It acts as a centralized repository where teams log, store, and track experiments, parameters, and artifacts like machine learning models, allowing for consistent collaboration and version control across complex model development projects.

What does CVE-2025-11201 mean for MLflow?

This CVE identifies a directory traversal weakness, classified as CWE-22, within the MLflow Tracking Server. In plain English, the software fails to properly sanitize user-provided file paths when creating models. This flaw allows an attacker to bypass intended directory restrictions, tricking the server into writing files to unauthorized locations, which ultimately leads to the execution of malicious code on the host system.

How is this MLflow vulnerability triggered?

An attacker triggers the vulnerability by sending a specially crafted request to the Tracking Server that includes a malicious file path during the model creation process. The bug specifically relies on this path manipulation to escape the designated storage directory. It is important to note that performing standard, authorized operations or accessing the server without these specifically manipulated paths does not trigger the exploit.

Is my MLflow instance at risk?

According to Halo Surface Signal, MLflow Tracking Servers are frequently deployed as centralized, network-accessible services to facilitate team collaboration. If your instance is reachable over a network—particularly in enterprise environments where these endpoints are exposed for model registration—it faces a higher risk because the vulnerability does not require authentication to be exploited.

What steps should I take if I use MLflow?

First, identify all instances of MLflow Tracking Server within your infrastructure and confirm their ownership. Prioritize assessing those that are network-accessible or critical to your operations. Once identified, consult your internal teams to plan for the necessary software updates to patch the affected versions, while implementing temporary network-level controls to restrict access to these servers in the interim.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.