MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

影響: pip:mlflow >= 3.10.0, < 3.17.0 → 3.17.0

On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as…

GitHub Advisory Databaseで読む

2026/10/28 06:26、GitHub Advisory Databaseが「MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Python。CVE: CVE-2026-116690。