CVE-2026-2614: MLflow arbitrary file read through model version creation handler

Summary

CVE-2026-2614 affects the `_create_model_version()` handler in `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier. A `CreateModelVersion` request carrying the tag `mlflow.prompt.is_prompt` bypasses source path validation, so an unauthenticated remote attacker can store an arbitrary local filesystem path as a model version source. `get_model_version_artifact_handler()` then serves files from that path without checking prompt status, allowing reads of arbitrary server files with a complete loss of confidentiality.

Mitigation

Fixed in version 3.10.0.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents

Related items

• MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
• HighCVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetchingSimilar attack · NVD/CVE Database
• InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
• LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
• MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database