CVE-2026-116690

Name of the Vulnerable Software and Affected Versions MLflow versions 3.10.0 through 3.16.1

Description An issue exists where a remote caller can read arbitrary files from the server filesystem with the privileges of the server process. This occurs because the prompt branch in the create model version() function accepts schemeless relative sources, as path validation is only performed when a source has a URL scheme. Additionally, the system identifies a prompt based on the presence of the mlflow.prompt.is prompt tag rather than its actual value.

An attacker can store a server-local path as a model version artifact location and subsequently use the /api/2.0/mlflow/model-versions/get-artifact endpoint to retrieve sensitive files, such as /etc/passwd or authentication databases. On unauthenticated servers, this is exploitable by any remote caller; on deployments using basic authentication, any authenticated user capable of creating registered models can exploit this to read the authentication database and admin password hashes.

Recommendations Update MLflow to version 3.17.0. As a temporary mitigation, restrict access to the /api/2.0/mlflow/model-versions/get-artifact endpoint or disable the ability for low-privileged users to create registered models.