{"data":{"id":"a153f60e-1f5f-448c-ae5b-ad05677513ae","title":"GHSA-m65p-9j7q-6w33: MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source","summary":"MLflow tracking servers running without authentication, the default for mlflow server, let a remote attacker read arbitrary files from the server's filesystem. The prompt branch of CreateModelVersion stores schemeless local paths such as ../../etc unchanged, and the model-versions/get-artifact endpoint later serves files from them with the server process's privileges. Servers using --app-name basic-auth are also affected, since any authenticated user can exploit this to read the authentication database, including the admin password hash.","solution":"Fixed in 3.17.0 by mlflow/mlflow#25870, which accepts only MLflow's own placeholder sources for prompt versions and requires the prompt tag to be true.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-m65p-9j7q-6w33","publishedAt":"2026-10-27T21:26:56.000Z","cveId":"CVE-2026-116690","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlflow@>= 3.10.0, < 3.17.0 (fixed: 3.17.0)"],"affectedPackageNames":["mlflow"],"affectedPackageRefs":["pypi:mlflow"],"affectedVendors":[],"affectedVendorsRaw":["MLflow"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-28T00:05:48.685Z","kevDateAdded":null,"advisoryAliases":["GHSA-m65p-9j7q-6w33"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-10-27T21:26:56.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}