{"id":"ghsa-ghsa-m65p-9j7q-6w33","seq":1713810,"kind":"advisory","title":"MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","permalink":"https://vulnpulse.app/items/ghsa-ghsa-m65p-9j7q-6w33","summary":"影響: pip:mlflow >= 3.10.0, < 3.17.0 → 3.17.0\nOn MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as…","severity":"high","techs":["python"],"cves":["CVE-2026-116690"],"tags":["GHSA-m65p-9j7q-6w33","mlflow"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T21:26:56.000Z","fetched_at":"2026-10-27T21:27:53.142Z"}