ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-116690

MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

Published Oct 27, 2026 · catalog updated Oct 28, 2026 · MLflow MLflow

Last checked Nov 1, 2026. A connected source was read within the last 7 days.

Patch now

CVE-2026-116690 is in the CISA known-exploited catalog. Confirm MLflow MLflow against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Same product and reporting

Severity
High7.5
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
0.56%
Remediation
Remediation guidance
Affected products
PyPI mlflow · pip mlflow · pypi mlflow · vendor MLflow MLflow · vendor mlflow MLflow

### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the handler that rejects URIs and absolute paths but runs path validation only when the source carries a URL scheme. A schemeless value such as , a plain relative name, , a percent-encoded path, or a Windows drive-letter path is therefore stored unchanged as the model version’s artifact location, and the later serves files from it with the privileges of the server process. The tag check also keyed on the presence of the tag rather than its value, so a false value still selected the weaker branch. Servers using are also affected: any authenticated user can create a registered model, so a low-privilege account can use this to read the authentication database, including the admin password hash. Affected: MLflow 3.10.0 through 3.16.1. Fixed in 3.17.0 by [mlflow/mlflow#25870](https://github.com/mlflow/mlflow/pull/25870), which accepts only MLflow’s own placeholder sources for prompt versions and requires the prompt tag to be . ### Details When creating a model version with the tag set to true, the request is handled by the prompt branch in . : The prompt branch does not call , , or for schemeless relative paths. The artifact-read sink later trusts the stored source: : calls and serves the resulting local file with . ### PoC Prerequisite: A reachable MLflow tracking server with model registry endpoints enabled. 1. Create a sentinel file on the server: 2. Send the following requests to the MLflow server to exploit the traversal: First, create a registered model: Next, create a prompt-tagged model version with the malicious relative source : Finally, retrieve the arbitrary file via the artifact download endpoint by supplying the target fil

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • PyPI mlflow3.10.0 → 3.17.0
  • pip mlflow>= 3.10.0, < 3.17.0
  • pypi mlflow>=3.10.0,<3.17.0
  • vendor MLflow MLflowversion unspecified
  • vendor mlflow MLflowversion unspecified

How to fix CVE-2026-116690

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-116690 is in the CISA known-exploited catalog. Confirm MLflow MLflow against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with 3.10.0 → 3.17.0, >= 3.10.0, < 3.17.0, >=3.10.0,<3.17.0. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

What should an analyst verify?

CWE-22: Path Traversal. EPSS 0.56%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 27, 2026 · GitHub Advisory Database

    Detected

    ### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the handler that rejects URIs and absolute paths but runs p

  2. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    mlflow fixed in 3.17.0

  3. Oct 27, 2026 · GitHub Advisory Database

    Fix available

    mlflow fixed in 3.17.0

  4. Oct 27, 2026 · GitHub Advisory Database

    Updated

    ### Summary On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the handler that rejects URIs and absolute paths but runs p

  5. Oct 28, 2026 · CISA KEV

    Known exploited

    Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

  6. Oct 28, 2026 · VulnCheck KEV

    Updated

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a s

Sources

  • CVE.orgVulnerability recordCVE-2026-116690

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-116690

    30-day exploitation probability 0.56%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-m65p-9j7q-6w33

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-116690

    On MLflow tracking servers running without authentication, which is the default for mlflow server, a remote attacker can read arbitrary files from the server’s filesystem by creating a model version tagged as a prompt whose source is a schemeless local path. The fix for CVE-2026-2614 in 3.10.0 added a prompt-specific branch to the CreateModelVersion handler that rejects file:// URIs and absolute p

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorypypi/mlflow/CVE-2026-116690.yml

    On MLflow tracking servers running without authentication, which is + the default for mlflow server, a remote attacker can read arbitrary files from the + server’s filesystem by creating a model version tagged as a prompt whose source + is a schemeless local path.\n\nThe fix for CVE-2026-2614 in 3.10.0 added a prompt-specific + branch to the handler that rejects URIs and absolute + paths but runs

    gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-m65p-9j7q-6w33

    MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

    osv.dev
  • PyPA Advisory DatabasePackage advisoryGHSA-m65p-9j7q-6w33

    MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source

    osv.dev
  • VulnCheck KEVConfirmed exploitationCVE-2026-116690

    MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL sc

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 31, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • VulnCheck KEVNov 1, 2026
  • FIRST EPSSOct 31, 2026
  • GitHub Advisory DatabaseOct 28, 2026
  • OpenSSF OSV / OSV ScannerOct 28, 2026
  • CVE.orgOct 28, 2026
  • PyPA Advisory DatabaseOct 28, 2026
  • GitLab Advisory DatabaseOct 28, 2026
  • GitLab Advisory DatabaseOct 28, 2026