MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

影響: pip:mlflow >= 3.10.0, < 3.17.0 → 3.17.0

On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as…

在 GitHub Advisory Database 阅读

2026/10/28 06:26，GitHub Advisory Database 发布了“MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Python。CVE：CVE-2026-116690。