{"id":"CVE-2026-116690","summary":"MLflow: Arbitrary file read on unauthenticated MLflow servers via prompt model version source","details":"MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.10.0 until 3.17.0, the prompt branch in _create_model_version() accepts schemeless relative sources because path validation runs only when a source has a URL scheme, and mlflow.prompt.is_prompt is interpreted by tag presence rather than a true value. A remote caller can store a server-local path as the model version artifact location and use /api/2.0/mlflow/model-versions/get-artifact to read files accessible to the MLflow server process. Default unauthenticated servers require no privileges, while basic-auth deployments are exposed to authenticated users who can create registered models. This issue is fixed in version 3.17.0.","aliases":["GHSA-m65p-9j7q-6w33"],"modified":"2026-10-28T10:45:43.561155822Z","published":"2026-10-27T19:42:35.798Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116690.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116690.json"},{"type":"FIX","url":"https://github.com/mlflow/mlflow/commit/81730a2ce4ebcd60d5d18f68c96f422ad7e30772"},{"type":"FIX","url":"https://github.com/mlflow/mlflow/pull/25870"},{"type":"WEB","url":"https://github.com/mlflow/mlflow/releases/tag/v3.17.0"},{"type":"ADVISORY","url":"https://github.com/mlflow/mlflow/security/advisories/GHSA-m65p-9j7q-6w33"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116690"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mlflow/mlflow","events":[{"introduced":"d0b97413e383796f1ca742b20cac74543185816c"},{"fixed":"6dd94c6de2932d22767769eec5b644e48c457ce8"},{"fixed":"81730a2ce4ebcd60d5d18f68c96f422ad7e30772"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"3.10.0"},{"fixed":"3.17.0"}]},{"range":[{"fixed":"81730a2ce4ebcd60d5d18f68c96f422ad7e30772"}],"source":"REFERENCES_COMMIT"},{"source":"REFERENCES_TAG","original_tag":"v3.17.0","range":[{"fixed":"6dd94c6de2932d22767769eec5b644e48c457ce8"}]}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-116690.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}