CVE-2025-11201

CVE-2025-11201 is a critical (CVSS 9.8) unauthenticated remote code execution vulnerability in the MLflow Tracking Server, caused by insufficient validation of user-supplied model file paths (CWE-22, path traversal). A remote attacker can trigger it by supplying a crafted file path in a model-creation request so that the path escapes the intended directory and is then used in file operations, with no authentication required. Successful exploitation allows arbitrary code execution in the context of the service account running the Tracking Server. Any deployment of MLflow Tracking Server reachable by untrusted clients is potentially affected; MLflow is a widely adopted open-source ML lifecycle and experiment-tracking platform, so both internet-exposed and internally reachable instances are in scope. It was disclosed via Trend Micro's Zero Day Initiative (ZDI-CAN-26921); it is not yet in CISA KEV and no public PoC is known, but EPSS assigns a 27% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade MLflow Tracking Server to the patched release identified in the vendor/ZDI advisory (the fixed version is not stated in the provided data), prioritizing any instance reachable by unauthenticated clients. Until patched, restrict network access to Tracking Servers (internal bind, firewall/VPN rules, or an authenticating reverse proxy in front of the server). Review server logs for unexpected or traversal-style path values in model-creation requests and check the service account for signs of compromise.