## MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

- 種別: advisory
- 重大度: high
- 関連技術: python
- CVE: CVE-2026-116690
- 公開日時: 2026-10-27T21:26:56.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-m65p-9j7q-6w33)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-m65p-9j7q-6w33

影響: pip:mlflow >= 3.10.0, < 3.17.0 → 3.17.0
On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as…