MLflow Tracking Server Directory Traversal Remote Code Execution Vulnerability

A directory traversal vulnerability allowing remote code execution has been identified in the MLflow Tracking Server. This issue arises from improper validation of user-supplied artifact file paths, which can be exploited to execute arbitrary code in the context of the service account. Notably, authentication is not required to exploit this vulnerability.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected MLflow Tracking Server installation, with the executed code running under the service account's privileges.

Remediation

MLflow has released a patch for this vulnerability. Users should update to the latest version of MLflow. For details on the update, refer to the MLflow GitHub repository.