MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
影響: pip:mlflow >= 3.10.0, < 3.17.0 → 3.17.0
On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as…
Read on GitHub Advisory Database
| CVE | CVE-2026-116690 |
|---|---|
| Source | GitHub Advisory Database |
| Fetched | 10/28/2026, 06:27 AM |
| Data | Markdown JSON |
On 10/28/2026, 06:26 AM, GitHub Advisory Database published "MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source" (type: Advisory). Severity is "High" (high). Related technologies: Python. CVE: CVE-2026-116690.