MLflow prompt model-version source arbitrary file read (CVE-2026-116690)
An incomplete fix for an earlier MLflow path check let schemeless relative paths be stored as a prompt model-version source, so the artifact endpoint served arbitrary files readable by the server process
categoryAI/ML and emerging attacksseverityHighlabnot yet measured
Example: mlflow (pip) 3.10.0 to before 3.17.0, CVSS 7.5; fixed in 3.17.0; follows incomplete fix of CVE-2026-2614
Classification
34 values: 34 machine-classified. What do these mean?
Exploitability
| Attack vector | Software vulnerabilities |
|---|---|
| Reach (CVSS) | Network |
| Attack complexity | Low |
| Attack requirements | Present |
| Privileges required | None |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Network required | Yes |
| Likelihood / prevalence | Medium |
| Maturity | Emerging |
Impact & scope
| Severity | High |
|---|---|
| Impact | Confidentiality |
| Platform | Web AppAI SystemLinux |
| Environment | On-premisesCloudAI system |
| Target asset class | ML model / agentServerData store |
| Kill-chain phase (tactic) | Initial AccessCollection |
| Remote support | Yes |
Detection & telemetry
| Noise level | Medium |
|---|---|
| Data sources (ATT&CK data components) | Application Log ContentFile AccessNetwork Traffic Content |
| Log sources | webserver:accessapplication:logsai:model-serving |
| Defense bypassed | System access controls |
| Attack permissions (ATT&CK) | User |
Detection & response
Mitigated by 2
Framework references
- Primary source: https://github.com/advisories/GHSA-m65p-9j7q-6w33
- cve: CVE-2026-116690 (primary)
- cwe: CWE-22
- attack: T1190
Evidence & sources
- ev-0001 (MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source (GHSA-m65p-9j7q-6w33)) — The CVE-2026-2614 fix validated only paths that included a URL scheme, so schemeless relative paths were stored; the artifact-retrieval endpoint then served files from those locations with the server's privileges
- ev-0002 (MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source (GHSA-m65p-9j7q-6w33)) — Affected: mlflow >= 3.10.0 and < 3.17.0; patched 3.17.0; CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5); CWE-22