GHSA-m65p-9j7q-6w33: MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
- Identifiers
- CVE-2026-116690GHSA-m65p-9j7q-6w33
- Published
- Record updated
- Affected
- mlflow >= 3.10.0, < 3.17.0
- Fixed in
- 3.17.0
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
MLflow tracking servers running without authentication, the default for mlflow server, let a remote attacker read arbitrary files from the server's filesystem. The prompt branch of CreateModelVersion stores schemeless local paths such as ../../etc unchanged, and the model-versions/get-artifact endpoint later serves files from them with the server process's privileges. Servers using --app-name basic-auth are also affected, since any authenticated user can exploit this to read the authentication database, including the admin password hash.
Mitigation
Fixed in 3.17.0 by mlflow/mlflow#25870, which accepts only MLflow's own placeholder sources for prompt versions and requires the prompt tag to be true.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- mlflowPyPILLM dependency since 2024-05-30 · 17 tracked dependents
Related items
- CriticalGHSA-26p8-2jq9-3vq9: MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modulesSimilar attack · GitHub Advisory Database
- MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSimilar attack · GitHub Advisory Database
- MediumGHSA-5h93-6whr-6q8j: Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodiesSimilar attack · GitHub Advisory Database
- MediumGHSA-rwrf-2pqf-9j8j: Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemasSimilar attack · GitHub Advisory Database
- MediumCyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan TargetsSimilar attack · The Hacker News