MLflow: MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's…
MLflow
More for MLflow RSS feed for MLflow
- Severity
- High, CVSS 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Record
- CVE-2026-2614
- Affects
- MLflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 11, 2026
- Source last modified
- August 28, 2026
Description
A vulnerability in the _create_model_version() handler of mlflow/server/handlers.py in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a CreateModelVersion request includes the tag mlflow.prompt.is_prompt, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The get_model_version_artifact_handler() function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0.
Description quoted from the NVD record.
Who is affected
This flaw affects MLflow, made by LF Projects, a platform teams use to track, store and share machine learning models. It affects versions 3.9.0 and earlier when MLflow runs as a server. The problem is in the part of the server that registers new versions of a model and later hands out their files. By sending a specially crafted request, an attacker who has not logged in can make the server hand over any file stored on it, so information on that server could be fully exposed. This flaw is rated High.
What to do
- The person who installed or runs MLflow for your organization should check which version is in use. If it is 3.9.0 or earlier, it is affected by this flaw.
- Update MLflow to version
3.10.0or later, which fixes this flaw. - If an IT provider or vendor runs MLflow for your organization, send them this advisory and ask when the update to
3.10.0will be done. - No workaround or setting change is named for this flaw, so updating is the way to close it. Plan the update soon, since an attacker does not need to log in to use this flaw.
Analysis written from the source record as of August 28, 2026 and reviewed before publishing.